Build a container security scanning pipeline with image analysis, vulnerability detection, compliance checks, and SBOM generation.
You are a container security specialist. Build a comprehensive Docker security scanning pipeline. ## Configuration - **Registry**: [REGISTRY e.g. Docker Hub / ECR / ACR / GCR / Harbor] - **CI/CD**: [CI e.g. GitHub Actions / GitLab CI / Jenkins / Azure DevOps] - **Scanning Tools**: [TOOLS e.g. Trivy / Grype / Snyk / Clair] - **Policy Engine**: [POLICY e.g. OPA / Kyverno / custom] - **Compliance Standard**: [STANDARD e.g. CIS Docker Benchmark / NIST / DISA STIG] ## Pipeline Stages ### 1. Dockerfile Linting (`lint/`) - Hadolint rules enforcement: - No root user (USER instruction required) - Pinned base image versions (no :latest) - COPY preferred over ADD - Multi-stage build verification - No secrets in build args - Minimal base image (distroless/alpine preferred) - Custom rules for [STANDARD] - Auto-fix suggestions for violations ### 2. Image Vulnerability Scanning (`scan/`) - OS package vulnerability scan with [TOOLS] - Application dependency scan (npm, pip, maven, nuget) - Severity filtering: Critical, High, Medium, Low - CVSS score threshold: fail build if score >= [THRESHOLD e.g. 7.0] - Known exploited vulnerabilities (KEV) check - False positive suppression with .trivyignore or similar - Scan result deduplication across layers ### 3. SBOM Generation (`sbom/`) - Generate Software Bill of Materials in CycloneDX or SPDX format - Include OS packages, application deps, and build tools - License compliance checking - Sign SBOM with cosign - Publish SBOM alongside image ### 4. Secret Detection (`secrets/`) - Scan all image layers for hardcoded secrets - Detect: API keys, passwords, certificates, private keys, tokens - Scan environment variables in image config - Check build history for leaked build args - Integration with TruffleHog or Gitleaks ### 5. Compliance Checks (`compliance/`) - CIS Docker Benchmark automated checks: - Container runs as non-root - Health check defined - No unnecessary capabilities - Read-only root filesystem capability - Resource limits defined - Policy enforcement with [POLICY] - Compliance report generation ### 6. CI/CD Integration (`ci/`) - [CI] pipeline configuration - Scan on every PR and merge to main - Block deployment on policy violations - Notification to security team on critical findings - Dashboard with historical scan trends - Exemption workflow for accepted risks Generate all pipeline configs, scanning scripts, and reporting templates.
Free to copy and use. Compatible with Claude 4 Opus, GPT-5, Gemini 2.0 Flash, Llama 4 Maverick.
Configure your CI/CD platform and container registry. Integrate scanning stages into your build pipeline. Set severity thresholds and policy rules. Review scan reports before promoting images to production.
Initial release
Sign in and download this prompt to leave a review.