Container scanners not scan software not added by package manager

• trivy

  38 12,743 9.6 Go

  Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues and hard-coded secrets

  

  - Use trivy or grype with software installed without package manager (via tar) e.g. eclipse-temurin in the alpine version. The java executable gets unpacked into /opt but is not recognized.

  https://github.com/aquasecurity/trivy/issues/2098

• syft

  14 2,727 9.5 Go

  CLI tool and library for generating a Software Bill of Materials from container images and filesystems

  

  https://github.com/anchore/syft/issues/994

• SonarLint

  www.sonarlint.org

  sponsored

  Clean code begins in your IDE with SonarLint. Up your coding game and discover issues early. SonarLint is a free plugin that helps you find & fix bugs and security issues from the moment you start writing code. Install from your favorite IDE marketplace today.

  

Suggest a related project