Awesome GitHub RepositoriesContainer Security Scanners

Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain. The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations agai

This project is a comprehensive, community-driven directory that serves as a centralized discovery hub for the container ecosystem. It functions as a structured knowledge base, aggregating a wide array of software tools, educational materials, and technical resources designed to assist developers and operators in mastering containerization technologies. The repository distinguishes itself through a meticulously organized taxonomy that maps the entire container lifecycle, from initial development and image building to orchestration, security, and infrastructure operations. By curating disparat

Harbor is a self-hosted, enterprise-grade container registry platform designed to store, sign, and scan container images and cloud-native artifacts. It provides a centralized repository that integrates directly with Kubernetes environments to manage the full lifecycle of software artifacts, from initial storage to production deployment. The platform distinguishes itself through a focus on security, governance, and multi-site availability. It features a pluggable vulnerability scanning framework that allows for the integration of various security engines, alongside content trust mechanisms tha

This project is a Docker educational resource and a collection of practical examples designed for learning containerization technologies. It serves as a guide for understanding container fundamentals, including the creation and management of custom images and the use of registries. The repository provides specialized references for container security hardening, such as managing kernel privileges and implementing supply chain security. It also includes tutorials for multi-container orchestration and a DevOps guide focused on CI/CD automation and image optimization. The material covers a broad

Slim is a comprehensive suite for container lifecycle management, providing tools for image inspection, optimization, security hardening, and service troubleshooting. It functions as a platform for analyzing containerized applications through both static metadata review and dynamic behavioral probing, enabling users to understand image composition and runtime dependencies. The project distinguishes itself by automating the creation of minimal, production-ready container images. It achieves this by removing unnecessary files and components, flattening image layers, and synthesizing restrictive

This project provides a framework for managing multi-agent systems, designed to automate complex software development, infrastructure, and business workflows. It functions as a multi-agent workflow orchestrator that routes tasks to domain-specific workers while maintaining state persistence and infrastructure automation. By leveraging large language models, the system decomposes high-level objectives into actionable plans, ensuring that complex operations are executed with consistency and reliability. The framework distinguishes itself through its hierarchical agent registry and policy-driven

Strix is an automated security research and vulnerability scanning platform that leverages language models to orchestrate complex security analysis tasks. It functions as a comprehensive framework for penetration testing and continuous security integration, allowing users to embed automated vulnerability research directly into development pipelines or execute it within isolated, containerized environments. The platform distinguishes itself through a multi-agent orchestration engine that coordinates specialized autonomous agents to perform parallel security assessments. By integrating LLM-agno

Grype is a command-line security scanner designed to identify known vulnerabilities within container images, filesystems, and software manifests. It functions as a software composition analysis tool that detects security flaws in application components and open-source libraries to support supply chain security. The tool distinguishes itself by reconstructing the final state of container images through layered filesystem inspection and normalizing diverse package formats into a unified dependency graph. It maintains a local cache of security advisories synchronized from multiple upstream sourc

Vuls is an agentless vulnerability scanner and CVE intelligence aggregator. It identifies security flaws in operating systems, containers, and network devices without requiring the installation of permanent software agents on target machines. The project distinguishes itself by cross-referencing software versions against multiple vulnerability databases, security advisories, and known exploit catalogs. It utilizes platform-based enumeration and lockfile analysis to detect vulnerabilities in network hardware, programming libraries, and website plugins. The tool covers a broad range of securit

Hadolint 是一个旨在验证容器构建配置的静态分析工具。它作为一个安全扫描器和配置审计员，将构建指令解析为结构化格式，以识别偏离安全和效率标准的行为。 该工具通过对嵌入式 shell 命令进行深度检查而脱颖而出。通过对这些脚本进行标记化和分析，它能检测到可能残留在容器镜像中的常见脚本错误和安全漏洞。它集成了外部分析工具，为这些内联命令提供专门的验证，确保容器结构和执行逻辑都得到评估。 除了基本的语法检查外，该实用程序还通过识别低效的层创建和不安全的配置设置来支持自动化工作流。它旨在集成到持续集成和部署流水线中，以便在构建镜像之前捕获配置问题。该项目提供了一个用于跨容器定义执行这些审计的命令行界面。

This project is a comprehensive collection of tutorials and guided laboratories designed to teach containerization, networking, and security using Docker. It serves as a learning path for building portable images and executing isolated processes. The materials provide specific guides for managing container clusters and scaling services through Docker Swarm and overlay networks. It includes a security handbook for implementing image scanning and secret management, as well as laboratories dedicated to modernizing legacy applications by wrapping older software installers into containers. The co

Clair is a container image vulnerability scanner and security analyzer. It performs static analysis of container images by matching package contents against vulnerability databases to identify security risks across different package formats and architectures. The project functions as both an image indexer and a vulnerability database manager. It processes container layers into intermediate representations to enable fast security lookups and synchronizes security metadata from multiple external sources to maintain a local registry. Capability areas include continuous security monitoring, whic

Clair is a container vulnerability scanner that performs static analysis of container images to identify known security vulnerabilities. It functions as an analyzer for OCI and Docker images, indexing their contents to detect security risks and outdated packages without requiring the containers to be running. The tool identifies vulnerabilities by matching indexed container components against security databases to find common vulnerabilities and exposures. This process involves analyzing filesystem layers to track the provenance and versioning of packages across the image hierarchy. The proj

Kompose is a suite of conversion utilities designed to translate container composition files into cloud-native cluster resource definitions. It serves as a migration tool that transforms local development specifications into production-ready manifests for Kubernetes and OpenShift. The tool functions as a translation engine that maps container specifications, network settings, and workload definitions into cluster resources. It supports target-specific manifest generation through dedicated providers, allowing for the creation of resources tailored to different environment distributions. The p

This project is a security compliance tool and configuration auditor designed to evaluate Docker deployments against industry security benchmarks. It functions as a script-based scanner that identifies misconfigurations and vulnerabilities within both the host operating system and container settings. The tool specifically implements the Center for Internet Security standards for Docker to verify host and container configurations. It enables a hardening workflow by comparing system states against these standards to identify security gaps and document compliance status. The audit engine suppor

Ko is a daemonless container image builder and OCI image generator specifically for Go applications. It compiles Go source code into binaries and packages them directly into container images, pushing them to registries without requiring a local container runtime or daemon. The tool specializes in multi-platform image distribution, producing images for various CPU architectures and operating systems from a single execution. It distinguishes itself by automating the entire pipeline from Go import paths to Kubernetes deployment or serverless function packaging for architectures like AWS Lambda.

Syft is a software bill of materials generator, container image scanner, and software dependency catalog. It analyzes container images and filesystems to produce comprehensive inventories of installed packages and dependencies in standard formats. Additionally, it serves as a software attestation tool and an SBOM format converter. The project distinguishes itself through the ability to create cryptographically signed attestations for software inventories to ensure provenance and integrity. It also provides the capability to transform software bills of materials between different industry sche

Security-101 is a vendor-agnostic, foundational cybersecurity learning curriculum organized into modular, framework-aligned modules. It is designed to build core knowledge across multiple security domains without tying content to specific products or platforms, making it suitable for both beginners and professionals seeking a structured introduction to the field. The curriculum is built around established security frameworks, including the MITRE ATT&CK framework for standardized threat analysis and the NIST Cybersecurity Framework for incident response workflows. It covers a broad range of do

该项目是一个容器化机器学习工作流引擎和编排器，旨在自动化 Kubernetes 集群上机器学习模型的端到端生命周期。它作为一个 MLOps 管道编译器，将领域特定语言转换为用于便携式和可扩展部署的结构化规范。 该平台提供了一个具有隔离命名空间和身份提供商认证的多租户环境。它通过结合基于容器的任务隔离、用于数据传递的强类型工件管理以及用于避免冗余计算的内容寻址结果缓存而脱颖而出。 该系统涵盖了全面的工作流编排，包括并行任务执行、循环运行调度和条件分支逻辑。它进一步支持实验跟踪、工作流指标收集以及可重用管道组件的管理，并能够为 CPU、内存和 GPU 配置特定的硬件资源请求。 该软件通过 Python SDK 分发，可部署在独立、本地或多租户环境中。

Discover 是一个基于 Bash 的渗透测试工具包，旨在自动化侦察、扫描和枚举任务。它是一个综合套件，用于开源情报收集、网络侦察、容器审计、有效载荷生成和安全数据解析。 该项目通过集成多个专业工作流脱颖而出，包括用于提取公司元数据的被动 OSINT 框架、用于映射攻击面的网络侦察套件，以及用于识别镜像和集群中漏洞与密钥的容器安全审计器。它还包含一个 Metasploit 有效载荷生成器，可跨各种架构创建反向 Shell 并自动化配置网络监听器。 该工具包涵盖了广泛的安全操作，包括针对 WAF 和 OAuth 配置错误的 Web 应用漏洞扫描、SSL 证书的基础设施审计，以及将结构化 XML 安全工具输出转换为 CSV 格式。 该工具包专为在 Kali Linux 和 Ubuntu 上运行而设计。