Documentation
¶
Overview ¶
Package imageaudit inspects a *built* container image — its configuration and its layer history — and reports hardening violations mapped to the CIS Docker Benchmark image controls (CIS-DI-*). Where the Dockerfile linter (phase 1a) audits the recipe, this module audits the baked artifact, so it works even on images that shipped with no Dockerfile at all: distroless base images, vendor images, anything you can `docker save`.
It reads the image via internal/oci (config JSON + per-layer file trees) and is deliberately split into a deterministic CIS core and an optional, off-by-default enrichment layer (the attack-surface score, see surface.go). The core never reads the wall clock or a random source: the same image always yields byte-identical findings, which is what the golden test pins.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Register ¶
Register adds the image-audit module to the registry with its default (deterministic CIS baseline) configuration. The master agent calls this from modules.Default() during integration; per SHARED_CONTRACT §2 this package never edits the shared registry file itself.
To enable the off-by-default attack-surface score in a given frontend, register a configured instance instead:
r.Register(imageaudit.New(imageaudit.WithAttackSurfaceScore()))
Types ¶
type Module ¶
type Module struct {
// contains filtered or unexported fields
}
Module is the built-image configuration & CIS-audit capability. It is configured through functional options; the zero value (from New()) is the deterministic CIS baseline with every enrichment feature off.
func New ¶
New returns an image-audit module. With no options it is the pure CIS baseline; pass WithAttackSurfaceScore to add the enrichment finding.
func (*Module) Analyze ¶
Analyze loads the image, parses its config, and runs the rule set. Per the engine contract a rule failure is recorded, never fatal; here the only fallible steps are load and config-parse, and a genuine load failure is worth surfacing to the caller as an error (the engine records it and continues).
func (*Module) Description ¶
type Option ¶
type Option func(*Module)
Option configures a Module at construction time.
func WithAttackSurfaceScore ¶
func WithAttackSurfaceScore() Option
WithAttackSurfaceScore turns on the DS-RAT-IMG-100 attack-surface score and hardening plan. Callers (a CLI flag, an MCP request) opt in explicitly.
Source Files