Awesome GitHub RepositoriesContainer Security Scanners

Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain. The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations agai

This project is a comprehensive, community-driven directory that serves as a centralized discovery hub for the container ecosystem. It functions as a structured knowledge base, aggregating a wide array of software tools, educational materials, and technical resources designed to assist developers and operators in mastering containerization technologies. The repository distinguishes itself through a meticulously organized taxonomy that maps the entire container lifecycle, from initial development and image building to orchestration, security, and infrastructure operations. By curating disparat

Harbor is a self-hosted, enterprise-grade container registry platform designed to store, sign, and scan container images and cloud-native artifacts. It provides a centralized repository that integrates directly with Kubernetes environments to manage the full lifecycle of software artifacts, from initial storage to production deployment. The platform distinguishes itself through a focus on security, governance, and multi-site availability. It features a pluggable vulnerability scanning framework that allows for the integration of various security engines, alongside content trust mechanisms tha

This project is a Docker educational resource and a collection of practical examples designed for learning containerization technologies. It serves as a guide for understanding container fundamentals, including the creation and management of custom images and the use of registries. The repository provides specialized references for container security hardening, such as managing kernel privileges and implementing supply chain security. It also includes tutorials for multi-container orchestration and a DevOps guide focused on CI/CD automation and image optimization. The material covers a broad

Slim is a comprehensive suite for container lifecycle management, providing tools for image inspection, optimization, security hardening, and service troubleshooting. It functions as a platform for analyzing containerized applications through both static metadata review and dynamic behavioral probing, enabling users to understand image composition and runtime dependencies. The project distinguishes itself by automating the creation of minimal, production-ready container images. It achieves this by removing unnecessary files and components, flattening image layers, and synthesizing restrictive

This project provides a framework for managing multi-agent systems, designed to automate complex software development, infrastructure, and business workflows. It functions as a multi-agent workflow orchestrator that routes tasks to domain-specific workers while maintaining state persistence and infrastructure automation. By leveraging large language models, the system decomposes high-level objectives into actionable plans, ensuring that complex operations are executed with consistency and reliability. The framework distinguishes itself through its hierarchical agent registry and policy-driven

Strix is an automated security research and vulnerability scanning platform that leverages language models to orchestrate complex security analysis tasks. It functions as a comprehensive framework for penetration testing and continuous security integration, allowing users to embed automated vulnerability research directly into development pipelines or execute it within isolated, containerized environments. The platform distinguishes itself through a multi-agent orchestration engine that coordinates specialized autonomous agents to perform parallel security assessments. By integrating LLM-agno

Grype is a command-line security scanner designed to identify known vulnerabilities within container images, filesystems, and software manifests. It functions as a software composition analysis tool that detects security flaws in application components and open-source libraries to support supply chain security. The tool distinguishes itself by reconstructing the final state of container images through layered filesystem inspection and normalizing diverse package formats into a unified dependency graph. It maintains a local cache of security advisories synchronized from multiple upstream sourc

Vuls is an agentless vulnerability scanner and CVE intelligence aggregator. It identifies security flaws in operating systems, containers, and network devices without requiring the installation of permanent software agents on target machines. The project distinguishes itself by cross-referencing software versions against multiple vulnerability databases, security advisories, and known exploit catalogs. It utilizes platform-based enumeration and lockfile analysis to detect vulnerabilities in network hardware, programming libraries, and website plugins. The tool covers a broad range of securit

Hadolint कंटेनर बिल्ड कॉन्फ़िगरेशन को मान्य करने के लिए डिज़ाइन किया गया एक स्टेटिक विश्लेषण टूल है। यह एक सुरक्षा स्कैनर और कॉन्फ़िगरेशन ऑडिटर के रूप में कार्य करता है, जो सुरक्षा और दक्षता मानकों से विचलन की पहचान करने के लिए बिल्ड निर्देशों को एक स्ट्रक्चर्ड फॉर्मेट में पार्स करता है। यह टूल एम्बेडेड शेल कमांड्स का गहरा निरीक्षण करके खुद को अलग करता है। इन स्क्रिप्ट्स को टोकनाइज़ और विश्लेषण करके, यह सामान्य स्क्रिप्टिंग त्रुटियों और सुरक्षा कमजोरियों का पता लगाता है जो अन्यथा कंटेनर इमेज के भीतर बनी रह सकती हैं। यह इन इनलाइन कमांड्स के लिए विशेष वैलिडेशन प्रदान करने के लिए बाहरी विश्लेषण टूल्स को एकीकृत करता है, यह सुनिश्चित करते हुए कि कंटेनर संरचना और निष्पादन लॉजिक दोनों का मूल्यांकन किया जाए। बुनियादी सिंटैक्स चेकिंग से परे, यूटिलिटी अक्षम लेयर निर्माण और असुरक्षित कॉन्फ़िगरेशन सेटिंग्स की पहचान करके स्वचालित वर्कफ़्लो का समर्थन करती है। इसे निरंतर एकीकरण और डिप्लॉयमेंट पाइपलाइनों में एकीकृत करने के लिए डिज़ाइन किया गया है ताकि इमेज बनने से पहले कॉन्फ़िगरेशन समस्याओं को पकड़ा जा सके। यह प्रोजेक्ट कंटेनर परिभाषाओं में इन ऑडिट्स को निष्पादित करने के लिए एक कमांड-लाइन इंटरफेस प्रदान करता है।

This project is a comprehensive collection of tutorials and guided laboratories designed to teach containerization, networking, and security using Docker. It serves as a learning path for building portable images and executing isolated processes. The materials provide specific guides for managing container clusters and scaling services through Docker Swarm and overlay networks. It includes a security handbook for implementing image scanning and secret management, as well as laboratories dedicated to modernizing legacy applications by wrapping older software installers into containers. The co

Clair is a container vulnerability scanner that performs static analysis of container images to identify known security vulnerabilities. It functions as an analyzer for OCI and Docker images, indexing their contents to detect security risks and outdated packages without requiring the containers to be running. The tool identifies vulnerabilities by matching indexed container components against security databases to find common vulnerabilities and exposures. This process involves analyzing filesystem layers to track the provenance and versioning of packages across the image hierarchy. The proj

Clair is a container image vulnerability scanner and security analyzer. It performs static analysis of container images by matching package contents against vulnerability databases to identify security risks across different package formats and architectures. The project functions as both an image indexer and a vulnerability database manager. It processes container layers into intermediate representations to enable fast security lookups and synchronizes security metadata from multiple external sources to maintain a local registry. Capability areas include continuous security monitoring, whic

Kompose is a suite of conversion utilities designed to translate container composition files into cloud-native cluster resource definitions. It serves as a migration tool that transforms local development specifications into production-ready manifests for Kubernetes and OpenShift. The tool functions as a translation engine that maps container specifications, network settings, and workload definitions into cluster resources. It supports target-specific manifest generation through dedicated providers, allowing for the creation of resources tailored to different environment distributions. The p

This project is a security compliance tool and configuration auditor designed to evaluate Docker deployments against industry security benchmarks. It functions as a script-based scanner that identifies misconfigurations and vulnerabilities within both the host operating system and container settings. The tool specifically implements the Center for Internet Security standards for Docker to verify host and container configurations. It enables a hardening workflow by comparing system states against these standards to identify security gaps and document compliance status. The audit engine suppor

Ko is a daemonless container image builder and OCI image generator specifically for Go applications. It compiles Go source code into binaries and packages them directly into container images, pushing them to registries without requiring a local container runtime or daemon. The tool specializes in multi-platform image distribution, producing images for various CPU architectures and operating systems from a single execution. It distinguishes itself by automating the entire pipeline from Go import paths to Kubernetes deployment or serverless function packaging for architectures like AWS Lambda.

Syft is a software bill of materials generator, container image scanner, and software dependency catalog. It analyzes container images and filesystems to produce comprehensive inventories of installed packages and dependencies in standard formats. Additionally, it serves as a software attestation tool and an SBOM format converter. The project distinguishes itself through the ability to create cryptographically signed attestations for software inventories to ensure provenance and integrity. It also provides the capability to transform software bills of materials between different industry sche

Security-101 is a vendor-agnostic, foundational cybersecurity learning curriculum organized into modular, framework-aligned modules. It is designed to build core knowledge across multiple security domains without tying content to specific products or platforms, making it suitable for both beginners and professionals seeking a structured introduction to the field. The curriculum is built around established security frameworks, including the MITRE ATT&CK framework for standardized threat analysis and the NIST Cybersecurity Framework for incident response workflows. It covers a broad range of do

This project is a containerized machine learning workflow engine and orchestrator designed to automate the end-to-end lifecycle of machine learning models on Kubernetes clusters. It functions as an MLOps pipeline compiler that transforms a domain-specific language into structured specifications for portable and scalable deployment. The platform provides a multi-tenant environment with isolated namespaces and identity provider authentication. It distinguishes itself through a combination of container-based task isolation, strongly typed artifact management for data passing, and content-address

Discover एक bash-आधारित पेनेट्रेशन टेस्टिंग टूलकिट है जिसे टोही, स्कैनिंग और गणना कार्यों को स्वचालित करने के लिए डिज़ाइन किया गया है। यह ओपन-सोर्स इंटेलिजेंस गैदरिंग, नेटवर्क टोही, कंटेनर ऑडिटिंग, पेलोड निर्माण और सुरक्षा डेटा पार्सिंग के लिए एक व्यापक सूट के रूप में कार्य करता है। यह प्रोजेक्ट कई विशेष वर्कफ़्लो को एकीकृत करके खुद को अलग करता है, जिसमें कंपनी मेटाडेटा निकालने के लिए एक पैसिव OSINT फ्रेमवर्क, अटैक सरफेस को मैप करने के लिए एक नेटवर्क टोही सूट, और इमेज और क्लस्टर में कमजोरियों और रहस्यों की पहचान करने के लिए एक कंटेनर सुरक्षा ऑडिटर शामिल है। इसमें एक Metasploit पेलोड जनरेटर भी शामिल है जो विभिन्न आर्किटेक्चर में रिवर्स शेल बनाता है और नेटवर्क लिसनर्स के कॉन्फ़िगरेशन को स्वचालित करता है। टूलकिट सुरक्षा संचालन की एक विस्तृत सतह को कवर करता है, जिसमें WAF और OAuth गलत कॉन्फ़िगरेशन के लिए वेब एप्लिकेशन भेद्यता स्कैनिंग, SSL प्रमाणपत्रों के लिए बुनियादी ढांचा ऑडिटिंग और संरचित XML सुरक्षा टूल आउटपुट को CSV प्रारूप में बदलना शामिल है। टूलकिट को Kali Linux और Ubuntu पर निष्पादन के लिए डिज़ाइन किया गया है।