vulkro container

Check the packages inside a built container image against the local vulnerability data.

vulkro container alpine:3.19
docker save myapp:latest -o myapp.tar && vulkro container ./myapp.tar

<IMAGE> is a Docker reference or a .tar from docker save. A reference needs the local docker command; without it, save the tar on another machine and scan the file. Vulkro never pulls from a registry, and the image contents and findings stay on your machine.

What it reads

• OS packages: apk, dpkg, and the SQLite rpm database (RHEL 9+, Fedora, Rocky, Alma). Older Berkeley DB and ndb rpm databases are skipped with a warning.
• Application packages: Java jars, npm node_modules and Python dist-info / egg-info, matched against the Maven, npm and PyPI data. Nested jars are not opened.
• Packages deleted in a later layer are not reported.

Flags

Flag	Description
-f, --format <FMT>	Any vulkro scan format. Default table.
--save	Save the result to scan history. Off by default.

Exit codes

0 no findings, 1 findings reported, 2 error.

See also: Dependencies and CVEs.