Documentation
¶
Overview ¶
Package container provides a container image scan source. It pulls and inspects OCI/Docker images layer by layer without requiring a running Docker daemon (daemon-less, via go-containerregistry).
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ContainerSource ¶
type ContainerSource struct {
// contains filtered or unexported fields
}
ContainerSource scans container image layers for secrets.
func New ¶
func New(imageRef string, opts ...Option) *ContainerSource
New creates a new ContainerSource for the given image reference.
func (*ContainerSource) Chunks ¶
func (s *ContainerSource) Chunks(ctx context.Context) <-chan source.Chunk
Chunks pulls the image and sends file contents from each layer as chunks.
func (*ContainerSource) Err ¶ added in v1.7.0
func (s *ContainerSource) Err() error
Err returns the first terminal error that aborted image scanning, or nil if it completed normally. It must only be called after the channel returned by Chunks has been fully drained (closed).
func (*ContainerSource) Type ¶
func (s *ContainerSource) Type() string
Type returns the source type identifier.
func (*ContainerSource) Validate ¶
func (s *ContainerSource) Validate() error
Validate checks that the image reference is parseable and accessible.
type Option ¶
type Option func(*ContainerSource)
Option configures a ContainerSource.
func WithBufferSize ¶
WithBufferSize sets the chunk channel buffer size. Values less than or equal to zero are ignored.
func WithExcludePaths ¶
WithExcludePaths sets glob patterns for layer file paths to exclude from scanning. Patterns are matched against each file's cleaned, slash-based path within the layer, mirroring filesystem.WithExcludePaths semantics.
func WithMaxFileSize ¶
WithMaxFileSize sets the maximum file size to extract from layers. Values less than or equal to zero are ignored.
func WithMaxImageSize ¶ added in v1.7.0
WithMaxImageSize sets the maximum number of decompressed bytes read across all of an image's layers, bounding total decompression work. Values less than or equal to zero are ignored.
func WithMaxLayerSize ¶ added in v1.7.0
WithMaxLayerSize sets the maximum number of decompressed bytes read from a single layer, guarding against decompression-bomb layers with an extreme compression ratio. Values less than or equal to zero are ignored.
Source Files