Dagda
A tool for static vulnerability analysis and runtime monitoring of Docker images and containers to detect malware and anomalous activities.
What is Dagda?
Dagda is an open-source tool that performs static analysis and runtime monitoring of Docker images and containers to enhance security. It scans for known vulnerabilities, malware, and other threats in containerized applications while monitoring running containers for anomalous activities. The tool integrates multiple vulnerability databases and uses ClamAV for malware detection to provide a comprehensive security assessment.
DevOps engineers, security professionals, and developers who deploy and manage Docker containers in production environments and need to ensure their container images are free from vulnerabilities and malicious code.
Dagda offers a unified, self-hosted solution that combines static vulnerability scanning with runtime behavioral monitoring specifically for Docker, unlike generic security tools. Its integration with Falco and support for multiple programming languages make it a versatile choice for securing containerized applications.
Overview
a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities
Use Cases
Best For
- Scanning Docker images for known vulnerabilities before deployment
- Detecting malware and trojans within containerized applications
- Monitoring running Docker containers for suspicious activities
- Auditing Docker daemon events for security compliance
- Analyzing dependencies in multi-language applications (Java, Python, Node.js, etc.)
- Maintaining a historical record of security analyses for Docker images
Not Ideal For
- Teams needing quick, out-of-the-box scanning without manual database setup and dependency installations
- Environments where kernel header installation is restricted or problematic, such as managed cloud services
- Projects requiring seamless integration with cloud-native security platforms or SaaS solutions
- Small-scale deployments where the overhead of running MongoDB and Falco is disproportionate to security needs
Pros & Cons
Pros
Integrates multiple databases including CVEs, Bugtraq IDs, and Red Hat advisories, providing thorough static analysis of OS packages and dependencies from the README's detailed query examples.
Uses the ClamAV antivirus engine to scan for trojans, viruses, and malware within Docker images, as shown in the static analysis output with detected threats like 'Worm.Sober'.
Integrates with Falco to monitor running containers for anomalous activities, such as unexpected setuid calls, providing behavioral security beyond static scans.
Supports analysis of dependencies from Java, Python, Node.js, JavaScript, Ruby, and PHP using OWASP Dependency Check and Retire.js, covering common application stacks with vulnerability details.
Stores all analysis reports in MongoDB, allowing for historical tracking and audit of Docker images and containers, as evidenced by the searchable history feature in the CLI.
Cons
Requires manual installation of MongoDB, kernel headers for Falco, and numerous Python dependencies, which the README admits can be error-prone and may need additional Sysdig installation in some distributions.
Initial database population takes several minutes, and static analyses can be slow, potentially delaying CI/CD pipelines, as noted in the usage instructions advising patience.
Lacks built-in integrations with popular CI/CD tools or cloud platforms; automation requires custom scripting using the REST API or CLI, with no mention of pre-built plugins.
The README relies on external wiki pages for details, and troubleshooting issues like kernel header errors may require additional research, as highlighted in the troubleshooting section.
Frequently Asked Questions
Related Projects
trivyFind vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
GrypeA vulnerability scanner for container images and filesystems
ClairVulnerability Static Analysis for Containers
Docker bench securityThe Docker Bench for Security is a script that checks for dozens of common best-practices around deploying Docker containers in production.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.