Documentation
¶
Overview ¶
Package dockercli is a thin, guarded wrapper around the local `docker` CLI. It powers a convenience feature of the dashboard/server: auto-detecting the images and containers already on the host and scanning them on click, or scanning an image by reference (the server `docker save`s it to a temp tar).
It is deliberately NOT part of the deterministic analysis core — it is an opt-in host integration that only works when a docker binary is present. All exec calls pass arguments as a vector (never a shell string) and validate any user-supplied reference against a strict charset, so there is no shell- or argument-injection surface.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnsureLocal ¶
EnsureLocal makes ref available to `docker save`: if the image is not already present, it is pulled. Requires network only on a cache miss.
func NormalizeRef ¶
NormalizeRef turns user input into a pullable image reference. It accepts a plain ref (`ubuntu:latest`, `ghcr.io/org/app@sha256:…`), a Docker Hub web URL (`https://hub.docker.com/_/ubuntu`, `.../r/bitnami/nginx`), or any registry URL with a scheme (`https://ghcr.io/org/app:tag`). It returns (ref, true) on success, or ("", false) when the input cannot be a reference (e.g. a webpage path, or something with spaces).
Types ¶
type Container ¶
type Container struct {
Name string `json:"name"`
Image string `json:"image"`
Status string `json:"status"`
State string `json:"state"`
ID string `json:"id"`
}
Container is a local container (running or stopped).
type Image ¶
type Image struct {
Repository string `json:"repository"`
Tag string `json:"tag"`
ID string `json:"id"`
Size string `json:"size"`
Created string `json:"created"`
// Ref is the best reference to scan by (repo:tag, or the ID when untagged).
Ref string `json:"ref"`
}
Image is a locally-present image.
Source Files