Tools for vulnerability scanning and compliance auditing of Docker containers and images using OpenSCAP.
Container Compliance is a set of tools for assessing the security compliance of container images and running containers. It provides vulnerability scanning and configuration auditing capabilities using the OpenSCAP framework to identify security issues in containerized environments.
DevOps engineers, security professionals, and system administrators who need to ensure container security compliance in production environments.
It offers standardized security assessments specifically designed for containers, integrating with the established OpenSCAP ecosystem while providing container-specific scanning capabilities that work with both images and running containers.
Assessing compliance of a container
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Leverages the OpenSCAP framework to evaluate containers against established security benchmarks like NIST and CIS, ensuring standardized compliance checks.
Automatically detects CVEs by downloading and applying OVAL definitions specific to the container's OS, as shown in the 'oscap-docker image-cve' command examples.
Supports both static image analysis and runtime container inspection, allowing for comprehensive security assessments across different container states.
Identifies the operating system within containers to apply appropriate security policies without manual configuration, streamlining the audit process.
The project is explicitly marked as obsolete in the README, with functionality now provided by oscap-docker in OpenSCAP, meaning no further development or support.
Requires installing multiple packages like openscap-scanner and docker-io, plus manual XML edits, as illustrated in the 'Exemplary usage' sections.
Primarily focused on Docker, with minimal evidence of support for other runtimes like rocket, despite initial mentions, making it less versatile.
Future features such as scanning all images were planned but never implemented, indicating the project was abandoned before reaching full maturity.