CLI Tool Commands and Parameters - Docker Images

The mimics sub-command, scan-image, creates vulnerability reports on Docker images intended to be used by developers or in CLI pipelines. After you have setup the command line interface (CLI) Infrastructure as Code (IaC) scanning tool via Docker or local executable, you're ready to start using it with your Docker images.

Prerequisites

Before scanning Docker images with the scanning tool, ensure you have a proper setup for the CLI Scanning tool

If you have questions or issues, reach out to us using the Customer Support Portal.

Command List & Parameters

The command list and parameters are the same regardless if you're using mimics via local executable or Docker.

Global Flags and Parameters

Global Flags

Commands

Flags and Parameters for scan-image

1. Scan Flags

2. Report Flags

3. Cache Flags

4. DB Flags

5. Image Flags

6. Vulnerability Flags

7. Secret Flags

8. License Flags

9. Rego Flags

10. Client/Server Flags

11. Config Flags

yaml
1
format: json
2
output: report.json
3
severity:
4
- HIGH
5
- CRITICAL

Using <code>mimics</code> to scan docker images

Use of the scanning tool depends on how you set it up. Below are examples using the scanning tool with each setup method.

Local Executable

To actually use the local executable, follow the pattern ./mimics [command] [flags] for Mac or mimic.exe [command] [flags] for Windows.

Scan Example

bash
1
# Scan a container image
2
  $ mimics scan-image python:3.4-alpine
3

4
  # Scan a container image from a tar archive
5
  $ mimics scan-image --input ruby-3.1.tar
6

7
  # Filter by severities
8
  $ mimics scan-image --severity HIGH,CRITICAL alpine:3.15
9

10
  # Ignore unfixed/unpatched vulnerabilities
11
  $ mimics scan-image --ignore-unfixed alpine:3.15
12

13
  # Scan a container image in client mode
14
  $ mimics scan-image --server http://127.0.0.1:4954 alpine:latest
15

16
  # Generate json result
17
  $ mimics scan-image --format json --output result.json alpine:3.15
18

19
  # Generate a report in the CycloneDX format
20
  $ mimics scan-image --format cyclonedx --output result.cdx alpine:3.15
21

22

Docker

Because the scanning tool is invoked using a public Docker image, the base command is more complicated than invoking the local executable:

bash
1
docker run [docker flags] public.ecr.aws/rapid7-insightcloudsec/ics/mimics:latest [mimics command] [mimics flags]

Scan Example

bash
1
docker run \
2
-v $(pwd):/data\
3
-e MIMICS_BASE_URL=$ICS_BASE_URL \
4
-e MIMICS_API_KEY=$ICS_API_KEY \
5
public.ecr.aws/rapid7-insightcloudsec/ics/mimics:latest python:3.4-alpine