drydock

Drydock

A lightweight CLI to audit container vulnerabilities in Google Cloud Artifact Registry.

Drydock fetches vulnerability data directly from Google Cloud's Container Analysis API, allowing you to filter out noise and focus on High/Critical threats across your repositories.

🚀 Installation

macOS & Linux (Recommended)

Run the following command to automatically download and install the latest binary.

Default Installation (to /usr/local/bin):

curl -sSfL https://raw.githubusercontent.com/hiro-o918/drydock/main/install.sh | sh

Custom Installation Path: To install to a specific directory (e.g., local bin), set the INSTALL_DIR variable:

curl -sSfL https://raw.githubusercontent.com/hiro-o918/drydock/main/install.sh | INSTALL_DIR=$HOME/.local/bin sh

(Make sure to add the target directory to your $PATH)

Go Install

If you have Go installed:

go install github.com/hiro-o918/drydock@latest

Manual Download

You can also download the pre-built binary from the Releases page.

⚡️ Usage

Quick Start

Scan a location for HIGH and CRITICAL vulnerabilities.

drydock -p my-project-id -l us-central1

Common Scenarios

1. Find CRITICAL vulnerabilities only Focus on the most urgent threats.

drydock -p my-project-id -l us-central1 -s CRITICAL

2. Find only fixable vulnerabilities Focus on vulnerabilities that have a fix available.

drydock -l us-central1 --fixable

3. Find Medium+ severity vulnerabilities that are fixable Focus on actionable vulnerabilities of medium or higher severity that have fixes available.

drydock -l us-central1 -s MEDIUM --fixable

4. Export report to CSV Generate a spreadsheet-compatible file for reporting.

drydock -p my-project-id -l us-central1 -o csv > report.csv

3. Inference Project ID from Environment If you don't specify a project ID, Drydock will attempt to infer it from your environment (e.g., environment variables, service account credentials, or GCE metadata server).

drydock -l us-central1

Options

🔑 Prerequisites

Ensure you have the following configured before running:

1. Authentication: Run gcloud auth application-default login or set GOOGLE_APPLICATION_CREDENTIALS.
2. Permissions: Your account needs:
   • roles/artifactregistry.reader (To list images)
   • roles/containeranalysis.occurrences.viewer (To read vulnerability data)

🛠 Using Drydock as a Library

Drydock can be used as a library in your Go applications, allowing you to implement custom exporters or integrate vulnerability scanning into your own tools.

Basic Usage

import "github.com/hiro-o918/drydock"

func main() {
    ctx := context.Background()

    // Initialize scanner with location and options
    scanner, err := drydock.NewScanner(
        ctx,
        "us-central1",
        drydock.WithProjectID("my-project-id"),
    )
    if err != nil {
        // Handle error
    }
    defer scanner.Close()

    // Run scan with HIGH severity threshold and only fixable vulnerabilities
    if err := scanner.Scan(ctx, schemas.SeverityHigh, true); err != nil {
        // Handle error
    }
}

Custom Exporters

You can implement custom exporters by implementing the Exporter interface:

type Exporter interface {
    Export(ctx context.Context, results []schemas.AnalyzeResult) error
}

Example of using a custom exporter:

// Create your custom exporter
customExporter := NewMyCustomExporter()

// Use it with the scanner
scanner, err := drydock.NewScanner(ctx, "us-central1",
    drydock.WithExporter(customExporter))

For a complete working example of a Markdown exporter, see the markdown_exporter example.