Containers Command Reference

The containers command runs a focused scan that evaluates only container-security Rego rules (rules with kind: oci) against Dockerfile and Containerfile manifests. It is equivalent to running:

vulnetix scan --enable-containers --no-sast --no-sca --no-secrets --no-iac --no-licenses

Package vulnerability analysis, general SAST rules, license analysis, secret detection, and IaC analysis are all disabled. Only rules that analyse container build files run.

Credentials are optional. When no credentials are configured the community fallback is used automatically.

Usage

vulnetix containers [flags]

Flags

FlagTypeDefaultDescription
--pathstring.Directory to scan
--depthint3Maximum recursion depth for file discovery
--excludestringArray-Exclude paths matching glob pattern (repeatable)
-o, --outputstringArray-Output target: json-sarif for stdout; .sarif file path for file output
--no-progressboolfalseSuppress the progress bar
--severitystring-Exit 1 if any finding meets or exceeds: low, medium, high, critical
--results-onlyboolfalseOnly output when findings exist
--dry-runboolfalseDetect files and check memory — zero API calls
--containers-include-ignoredboolfalseInclude files matched by .gitignore (default: gitignored paths are skipped)

Detected File Types

The containers command scans files identified as container, Kubernetes and Helm manifests, extracting the referenced images as pkg:oci/… components (each annotated with its registry type and a private-registry flag):

FilenameLanguageWhat is extracted
Dockerfile / Containerfile / *.dockerfiledockerFROM base images + RUN-installed OS packages
compose.yaml / docker-compose.ymldockerservice image: references
*.yaml with apiVersion + kindkubernetespod-template images (Pod / Deployment / StatefulSet / DaemonSet / Job / CronJob, incl. init & ephemeral containers)
Chart.yamlhelmchart dependencies (pkg:helm/…) + sibling values.yaml images

What Gets Detected

Container security rules check for common Dockerfile misconfigurations:

Rule IDSeverityName
VNX-DOCKER-001MediumMissing USER directive (running as root)
VNX-DOCKER-002MediumFROM with :latest tag (unpinned base image)
VNX-DOCKER-003MediumMissing HEALTHCHECK instruction
VNX-DOCKER-004MediumPackage manager cache not cleared in same layer
VNX-DOCKER-005HighSecrets or credentials in ENV instruction
VNX-DOCKER-006MediumPrivileged port exposure (< 1024)
VNX-DOCKER-007MediumADD instruction used instead of COPY
VNX-DOCKER-008MediumMultiple RUN instructions that could be combined

See the Docker rules section for full details.

Examples

# Container scan of the current directory
vulnetix containers

# Scan a specific directory
vulnetix containers --path /path/to/project

# Break the build on any container finding
vulnetix containers --severity low

# Emit SARIF JSON to stdout
vulnetix containers --output json-sarif

# Write SARIF to a file
vulnetix containers --output containers.sarif

# Silent when no issues found
vulnetix containers --results-only

Output Files

PathDescription
.vulnetix/sast.sarifSARIF 2.1.0 report from container analysis
.vulnetix/memory.yamlScan state record (timestamp, finding counts, git context)

Exit Codes

CodeMeaning
0Scan completed successfully (no threshold breach)
1A gate was breached (--severity), or a fatal error occurred

Known false negatives

Detection is deliberately conservative — a missed detection is preferred over a wrong one. Not detected, by design:

  • Images mirrored to private or organisation-local registries when matching official-image heuristics (base-image analysis follows the reference as written).
  • Build-arg ($VAR) and Helm-templated ({{ ... }}) image references — placeholders are dropped, never guessed.
  • Packages installed by scripts fetched at build time (curl | sh) rather than by a recognised package manager invocation.
  • A malformed image digest is dropped rather than reported as a version — it never becomes a fabricated value.

Absence of a finding is not verified absence of container risk.