Directories
¶
| Path | Synopsis |
|---|---|
|
Package admission is the Kubernetes ValidatingWebhook half of Phase 4.
|
Package admission is the Kubernetes ValidatingWebhook half of Phase 4. |
|
Package attacksim is a SAFE, offline adversary-emulation harness.
|
Package attacksim is a SAFE, offline adversary-emulation harness. |
|
Package attest builds and verifies in-toto attestations wrapped in DSSE envelopes, re-implemented on internal/sig (no in-toto or sigstore libraries).
|
Package attest builds and verifies in-toto attestations wrapped in DSSE envelopes, re-implemented on internal/sig (no in-toto or sigstore libraries). |
|
Package authz implements a Docker daemon authorization plugin (CAPABILITY_SPEC domain 8 / 15).
|
Package authz implements a Docker daemon authorization plugin (CAPABILITY_SPEC domain 8 / 15). |
|
Package cli is the command-line frontend.
|
Package cli is the command-line frontend. |
|
Package compliance is the shared machinery for hardening-benchmark auditing (CAPABILITY_SPEC domain 10).
|
Package compliance is the shared machinery for hardening-benchmark auditing (CAPABILITY_SPEC domain 10). |
|
Package connector delivers a finished Report to an external destination (webhook, chat, CI artifact, …).
|
Package connector delivers a finished Report to an external destination (webhook, chat, CI artifact, …). |
|
Package dockercli is a thin, guarded wrapper around the local `docker` CLI.
|
Package dockercli is a thin, guarded wrapper around the local `docker` CLI. |
|
Package engine is the core of docker-security: it defines the analysis Target, the Finding/Report model, the Module plugin interface, and the Engine that runs registered modules against a Target.
|
Package engine is the core of docker-security: it defines the analysis Target, the Finding/Report model, the Module plugin interface, and the Engine that runs registered modules against a Target. |
|
Package harden is the deterministic core for runtime confinement: it turns observed (or declared) workload behaviour into least-privilege seccomp and AppArmor profiles, and verifies a container/pod/OCI runtime spec against a hardening baseline (non-root, dropped caps, no-new-privileges, read-only rootfs, no host namespaces, no docker.sock, cgroup limits, GPU isolation, …).
|
Package harden is the deterministic core for runtime confinement: it turns observed (or declared) workload behaviour into least-privilege seccomp and AppArmor profiles, and verifies a container/pod/OCI runtime spec against a hardening baseline (non-root, dropped caps, no-new-privileges, read-only rootfs, no host namespaces, no docker.sock, cgroup limits, GPU isolation, …). |
|
Package k8syaml is a minimal, dependency-free YAML reader scoped to the subset Kubernetes manifests actually use: indentation-based mappings and sequences, block scalars are not needed, and values are strings/bools/ints/null.
|
Package k8syaml is a minimal, dependency-free YAML reader scoped to the subset Kubernetes manifests actually use: indentation-based mappings and sequences, block scalars are not needed, and values are strings/bools/ints/null. |
|
Package license implements license-policy evaluation over an SBOM: it turns the licenses the SBOM already detects (internal/sbom captures them per component) into a gate.
|
Package license implements license-policy evaluation over an SBOM: it turns the licenses the SBOM already detects (internal/sbom captures them per component) into a gate. |
|
Package malware is a deterministic, fully-offline static scanner for known-bad content in image layers: cryptominer binaries, web/reverse shells, persistence droppers, and known-bad file hashes.
|
Package malware is a deterministic, fully-offline static scanner for known-bad content in image layers: cryptominer binaries, web/reverse shells, persistence droppers, and known-bad file hashes. |
|
Package mcp implements a Model Context Protocol server that exposes the docker-security engine to AI agents.
|
Package mcp implements a Model Context Protocol server that exposes the docker-security engine to AI agents. |
|
Package modules wires the available capability modules into a registry.
|
Package modules wires the available capability modules into a registry. |
|
attacksim
Package attacksim is the engine module wrapper around internal/attacksim.
|
Package attacksim is the engine module wrapper around internal/attacksim. |
|
dockerbench
Package dockerbench assesses a Docker host and daemon against the CIS Docker Benchmark (CAPABILITY_SPEC domain 10).
|
Package dockerbench assesses a Docker host and daemon against the CIS Docker Benchmark (CAPABILITY_SPEC domain 10). |
|
dockerfile
Package dockerfile implements static analysis and linting of Dockerfiles.
|
Package dockerfile implements static analysis and linting of Dockerfiles. |
|
harden
Package harden is the capability module that surfaces runtime-confinement findings through the engine.
|
Package harden is the capability module that surfaces runtime-confinement findings through the engine. |
|
imageaudit
Package imageaudit inspects a *built* container image — its configuration and its layer history — and reports hardening violations mapped to the CIS Docker Benchmark image controls (CIS-DI-*).
|
Package imageaudit inspects a *built* container image — its configuration and its layer history — and reports hardening violations mapped to the CIS Docker Benchmark image controls (CIS-DI-*). |
|
k8smanifest
Package k8smanifest is the offline Kubernetes-manifest linter (CAPABILITY_SPEC domains 8/10).
|
Package k8smanifest is the offline Kubernetes-manifest linter (CAPABILITY_SPEC domains 8/10). |
|
kubebench
Package kubebench assesses a Kubernetes cluster against a subset of the CIS Kubernetes Benchmark (CAPABILITY_SPEC domain 10).
|
Package kubebench assesses a Kubernetes cluster against a subset of the CIS Kubernetes Benchmark (CAPABILITY_SPEC domain 10). |
|
license
Package license is the engine module that gates an image's component licenses against an allow/deny policy (CAPABILITY_SPEC domain 1 — license-policy gating).
|
Package license is the engine module that gates an image's component licenses against an allow/deny policy (CAPABILITY_SPEC domain 1 — license-policy gating). |
|
malware
Package malware is the engine module for static malware/cryptominer scanning of image layers (CAPABILITY_SPEC domains 3/11, static side).
|
Package malware is the engine module for static malware/cryptominer scanning of image layers (CAPABILITY_SPEC domains 3/11, static side). |
|
netpolicy
Package netpolicy is the engine module for Phase 6 (CAPABILITY_SPEC domain 6): network egress analysis and least-privilege policy generation.
|
Package netpolicy is the engine module for Phase 6 (CAPABILITY_SPEC domain 6): network egress analysis and least-privilege policy generation. |
|
policy
Package policy is the engine module and command surface for policy-as-code.
|
Package policy is the engine module and command surface for policy-as-code. |
|
rbac
Package rbac is the engine module wrapper around internal/rbac.
|
Package rbac is the engine module wrapper around internal/rbac. |
|
registry
Package registry implements the registry-security & artifact-management capability (CAPABILITY_SPEC domain 13).
|
Package registry implements the registry-security & artifact-management capability (CAPABILITY_SPEC domain 13). |
|
runtime
Package runtime is the engine-module face of the runtime sensor.
|
Package runtime is the engine-module face of the runtime sensor. |
|
sbom
Package sbom is the engine module wrapper around internal/sbom.
|
Package sbom is the engine module wrapper around internal/sbom. |
|
secrets
Package secrets is the engine module wrapper around internal/secrets.
|
Package secrets is the engine module wrapper around internal/secrets. |
|
verify
Package verify is the engine module and command surface for supply-chain verification.
|
Package verify is the engine module and command surface for supply-chain verification. |
|
vuln
Package vuln is the engine module for vulnerability scanning (CAPABILITY_SPEC domain 2).
|
Package vuln is the engine module for vulnerability scanning (CAPABILITY_SPEC domain 2). |
|
Package netmon is the offline core of Phase 6: network flow observability and egress analysis.
|
Package netmon is the offline core of Phase 6: network flow observability and egress analysis. |
|
Package oci loads container images into flat file trees that catalogers can walk.
|
Package oci loads container images into flat file trees that catalogers can walk. |
|
Package plugin runs third-party analyzers out of process, so the community (and other AI tools) can extend detection without forking or being linked into the binary.
|
Package plugin runs third-party analyzers out of process, so the community (and other AI tools) can extend detection without forking or being linked into the binary. |
|
Package policy is a deterministic, dependency-free policy-as-code engine for docker-security.
|
Package policy is a deterministic, dependency-free policy-as-code engine for docker-security. |
|
Package rbac analyzes Kubernetes and Docker identity configuration for over-privilege and privilege-escalation paths.
|
Package rbac analyzes Kubernetes and Docker identity configuration for over-privilege and privilege-escalation paths. |
|
Package registry is a from-scratch OCI distribution (registry v2) client plus a small in-memory registry for offline tests and demos.
|
Package registry is a from-scratch OCI distribution (registry v2) client plus a small in-memory registry for offline tests and demos. |
|
Package report renders an engine.Report into human- and machine-readable formats.
|
Package report renders an engine.Report into human- and machine-readable formats. |
|
Package runtime is the offline core of the runtime threat-detection sensor (dsecrat-runtime).
|
Package runtime is the offline core of the runtime threat-detection sensor (dsecrat-runtime). |
|
Package sbom builds a Software Bill of Materials from a container image or a filesystem: it loads the image (via internal/oci), walks the flattened file tree with a set of catalogers (OS package DBs and language manifests), and serializes the result to SPDX 2.3 and CycloneDX 1.5.
|
Package sbom builds a Software Bill of Materials from a container image or a filesystem: it loads the image (via internal/oci), walks the flattened file tree with a set of catalogers (OS package DBs and language manifests), and serializes the result to SPDX 2.3 and CycloneDX 1.5. |
|
internal/secrets/confidence.go
|
internal/secrets/confidence.go |
|
Package server is the HTTP/web frontend.
|
Package server is the HTTP/web frontend. |
|
Package sig re-implements the core of a Sigstore/Cosign-style signing stack on top of the Go standard library — no cosign, no sigstore, no external crypto.
|
Package sig re-implements the core of a Sigstore/Cosign-style signing stack on top of the Go standard library — no cosign, no sigstore, no external crypto. |
|
Package store persists scan results and SBOM inventory so the platform can answer questions that a single stateless scan cannot: "which of the images we have ever scanned contain component X at version Y?" (the blast-radius query a team runs the morning a zero-day drops), "is our critical count trending up?", and "who owns the image with the most findings?".
|
Package store persists scan results and SBOM inventory so the platform can answer questions that a single stateless scan cannot: "which of the images we have ever scanned contain component X at version Y?" (the blast-radius query a team runs the morning a zero-day drops), "is our critical count trending up?", and "who owns the image with the most findings?". |
|
Package vulndb is the offline, normalized advisory store behind the vuln module.
|
Package vulndb is the offline, normalized advisory store behind the vuln module. |
|
Package watch turns dsecrat's one-shot analysis into continuous monitoring.
|
Package watch turns dsecrat's one-shot analysis into continuous monitoring. |
|
Package web serves the embedded single-page dashboard.
|
Package web serves the embedded single-page dashboard. |
Click to show internal directories.
Click to hide internal directories.