OpenSCAP
Tools for vulnerability scanning and compliance auditing of Docker containers and images using OpenSCAP.
What is OpenSCAP?
Container Compliance is a set of tools for assessing the security compliance of container images and running containers. It provides vulnerability scanning and configuration auditing capabilities using the OpenSCAP framework to identify security issues in containerized environments.
DevOps engineers, security professionals, and system administrators who need to ensure container security compliance in production environments.
It offers standardized security assessments specifically designed for containers, integrating with the established OpenSCAP ecosystem while providing container-specific scanning capabilities that work with both images and running containers.
Overview
Assessing compliance of a container
Use Cases
Best For
- Scanning Docker images for known vulnerabilities before deployment
- Auditing running containers against security compliance benchmarks
- Integrating security checks into CI/CD pipelines for containerized applications
- Automating security assessments of container registries
- Ensuring containers meet regulatory compliance requirements
- Identifying configuration issues in containerized environments
Not Ideal For
- Projects starting new container security initiatives from scratch
- Teams requiring active maintenance and up-to-date security definitions
- Environments using container runtimes other than Docker (e.g., containerd, Podman)
- Users seeking simple, out-of-the-box tools without complex dependency management
Pros & Cons
Pros
Leverages the OpenSCAP framework to evaluate containers against established security benchmarks like NIST and CIS, ensuring standardized compliance checks.
Automatically detects CVEs by downloading and applying OVAL definitions specific to the container's OS, as shown in the 'oscap-docker image-cve' command examples.
Supports both static image analysis and runtime container inspection, allowing for comprehensive security assessments across different container states.
Identifies the operating system within containers to apply appropriate security policies without manual configuration, streamlining the audit process.
Cons
The project is explicitly marked as obsolete in the README, with functionality now provided by oscap-docker in OpenSCAP, meaning no further development or support.
Requires installing multiple packages like openscap-scanner and docker-io, plus manual XML edits, as illustrated in the 'Exemplary usage' sections.
Primarily focused on Docker, with minimal evidence of support for other runtimes like rocket, despite initial mentions, making it less versatile.
Future features such as scanning all images were planned but never implemented, indicating the project was abandoned before reaching full maturity.
Frequently Asked Questions
Related Projects
gvisorApplication Kernel for Containers
Docker bench securityThe Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
gossQuick and Easy server testing/validation
baneCustom & better AppArmor profile generator for Docker containers.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.