Docker Scan Plugin in Java: Comprehensive Container Security Scanning

Docker Scan provides security scanning for Docker images, identifying vulnerabilities in your containerized Java applications.

Understanding Docker Scan

What is Docker Scan?

Built-in Docker security scanning tool
Identifies vulnerabilities in container images
Integrates with Snyk's vulnerability database
Provides remediation guidance

Key Features:

Image Scanning: Analyze Docker images for known vulnerabilities
Dependency Analysis: Scan application dependencies within containers
CI/CD Integration: Automated scanning in pipelines
Policy Enforcement: Define and enforce security policies
Remediation Guidance: Get fix recommendations

Setup and Dependencies

1. Docker Scan Installation

# Docker Scan comes built-in with Docker Desktop # For Linux, install separately curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo apt-key add - sudo add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" sudo apt-get update sudo apt-get install docker-scan # Verify installation docker scan --version

2. Maven Dependencies for Integration

<properties> <docker-maven-plugin.version>0.40.0</docker-maven-plugin.version> <jib-maven-plugin.version>3.3.1</jib-maven-plugin.version> <testcontainers.version>1.18.3</testcontainers.version> </properties> <dependencies> <!-- Docker Java Client --> <dependency> <groupId>com.github.docker-java</groupId> <artifactId>docker-java</artifactId> <version>3.3.0</version> </dependency> <!-- TestContainers for integration testing --> <dependency> <groupId>org.testcontainers</groupId> <artifactId>testcontainers</artifactId> <version>${testcontainers.version}</version> <scope>test</scope> </dependency> <!-- JSON Processing --> <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.15.2</version> </dependency> </dependencies> <build> <plugins> <!-- Docker Maven Plugin --> <plugin> <groupId>io.fabric8</groupId> <artifactId>docker-maven-plugin</artifactId> <version>${docker-maven-plugin.version}</version> </plugin> <!-- Jib for container building --> <plugin> <groupId>com.google.cloud.tools</groupId> <artifactId>jib-maven-plugin</artifactId> <version>${jib-maven-plugin.version}</version> </plugin> </plugins> </build>

3. Gradle Configuration

plugins { id 'com.google.cloud.tools.jib' version '3.3.1' id 'com.bmuschko.docker-remote-api' version '9.3.2' } dependencies { implementation 'com.github.docker-java:docker-java:3.3.0' testImplementation 'org.testcontainers:testcontainers:1.18.3' }

Docker Scan Integration

1. Basic Docker Scan Service

package com.yourapp.docker; import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.ObjectMapper; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.stereotype.Service; import java.io.BufferedReader; import java.io.IOException; import java.io.InputStreamReader; import java.util.ArrayList; import java.util.List; @Service public class DockerScanService { private static final Logger logger = LoggerFactory.getLogger(DockerScanService.class); private final ObjectMapper objectMapper = new ObjectMapper(); public ScanResult scanImage(String imageName) throws IOException, InterruptedException { return scanImage(imageName, new ScanOptions()); } public ScanResult scanImage(String imageName, ScanOptions options) throws IOException, InterruptedException { List<String> command = buildScanCommand(imageName, options); logger.info("Executing Docker scan: {}", String.join(" ", command)); ProcessBuilder processBuilder = new ProcessBuilder(command); Process process = processBuilder.start(); // Read output StringBuilder output = new StringBuilder(); try (BufferedReader reader = new BufferedReader( new InputStreamReader(process.getInputStream()))) { String line; while ((line = reader.readLine()) != null) { output.append(line).append("\n"); } } // Read errors StringBuilder errors = new StringBuilder(); try (BufferedReader errorReader = new BufferedReader( new InputStreamReader(process.getErrorStream()))) { String line; while ((line = errorReader.readLine()) != null) { errors.append(line).append("\n"); } } int exitCode = process.waitFor(); String result = output.toString(); if (exitCode != 0) { throw new DockerScanException("Docker scan failed: " + errors.toString()); } return parseScanResult(result, imageName); } private List<String> buildScanCommand(String imageName, ScanOptions options) { List<String> command = new ArrayList<>(); command.add("docker"); command.add("scan"); if (options.isJsonOutput()) { command.add("--json"); } if (options.getSeverityThreshold() != null) { command.add("--severity"); command.add(options.getSeverityThreshold()); } if (options.isDependencyTree()) { command.add("--dependency-tree"); } if (options.isExcludeBase()) { command.add("--exclude-base"); } if (options.getFile() != null) { command.add("--file"); command.add(options.getFile()); } command.add(imageName); return command; } private ScanResult parseScanResult(String jsonResult, String imageName) throws IOException { JsonNode root = objectMapper.readTree(jsonResult); ScanResult result = new ScanResult(); result.setImageName(imageName); result.setScanTimestamp(root.path("scanTimestamp").asText()); result.setVulnerabilities(new ArrayList<>()); JsonNode vulnerabilities = root.path("vulnerabilities"); if (vulnerabilities.isArray()) { for (JsonNode vuln : vulnerabilities) { Vulnerability vulnerability = parseVulnerability(vuln); result.getVulnerabilities().add(vulnerability); } } // Calculate summary calculateSummary(result); return result; } private Vulnerability parseVulnerability(JsonNode vuln) { Vulnerability vulnerability = new Vulnerability(); vulnerability.setId(vuln.path("id").asText()); vulnerability.setTitle(vuln.path("title").asText()); vulnerability.setDescription(vuln.path("description").asText()); vulnerability.setSeverity(vuln.path("severity").asText()); vulnerability.setPackageName(vuln.path("packageName").asText()); vulnerability.setVersion(vuln.path("version").asText()); vulnerability.setFixedIn(vuln.path("fixedIn").asText()); vulnerability.setCvssScore(vuln.path("cvssScore").asDouble()); vulnerability.setCve(vuln.path("identifiers").path("CVE").asText()); return vulnerability; } private void calculateSummary(ScanResult result) { Summary summary = new Summary(); List<Vulnerability> vulnerabilities = result.getVulnerabilities(); summary.setTotal(vulnerabilities.size()); summary.setCritical((int) vulnerabilities.stream() .filter(v -> "critical".equalsIgnoreCase(v.getSeverity())) .count()); summary.setHigh((int) vulnerabilities.stream() .filter(v -> "high".equalsIgnoreCase(v.getSeverity())) .count()); summary.setMedium((int) vulnerabilities.stream() .filter(v -> "medium".equalsIgnoreCase(v.getSeverity())) .count()); summary.setLow((int) vulnerabilities.stream() .filter(v -> "low".equalsIgnoreCase(v.getSeverity())) .count()); result.setSummary(summary); } } @Data public class ScanResult { private String imageName; private String scanTimestamp; private List<Vulnerability> vulnerabilities; private Summary summary; private boolean compliant; } @Data public class Vulnerability { private String id; private String title; private String description; private String severity; private String packageName; private String version; private String fixedIn; private double cvssScore; private String cve; private List<String> references; } @Data public class Summary { private int total; private int critical; private int high; private int medium; private int low; } @Data public class ScanOptions { private boolean jsonOutput = true; private String severityThreshold; private boolean dependencyTree = false; private boolean excludeBase = false; private String file; public static ScanOptions defaultOptions() { return new ScanOptions(); } public static ScanOptions strictOptions() { ScanOptions options = new ScanOptions(); options.setSeverityThreshold("high"); options.setJsonOutput(true); return options; } } public class DockerScanException extends RuntimeException { public DockerScanException(String message) { super(message); } public DockerScanException(String message, Throwable cause) { super(message, cause); } }

2. Advanced Security Policy Engine

@Service public class SecurityPolicyEngine { private final SecurityPolicy policy; public PolicyEvaluation evaluateScanResult(ScanResult scanResult) { PolicyEvaluation evaluation = new PolicyEvaluation(); evaluation.setScanResult(scanResult); evaluation.setViolations(new ArrayList<>()); // Check critical vulnerabilities if (policy.getMaxCritical() >= 0 && scanResult.getSummary().getCritical() > policy.getMaxCritical()) { evaluation.getViolations().add( new PolicyViolation("CRITICAL_VULNERABILITIES", "Exceeded maximum critical vulnerabilities: " + scanResult.getSummary().getCritical() + " > " + policy.getMaxCritical()) ); } // Check high vulnerabilities if (policy.getMaxHigh() >= 0 && scanResult.getSummary().getHigh() > policy.getMaxHigh()) { evaluation.getViolations().add( new PolicyViolation("HIGH_VULNERABILITIES", "Exceeded maximum high vulnerabilities: " + scanResult.getSummary().getHigh() + " > " + policy.getMaxHigh()) ); } // Check specific prohibited vulnerabilities checkProhibitedVulnerabilities(scanResult, evaluation); // Check CVSS score threshold checkCvssThreshold(scanResult, evaluation); evaluation.setCompliant(evaluation.getViolations().isEmpty()); return evaluation; } private void checkProhibitedVulnerabilities(ScanResult scanResult, PolicyEvaluation evaluation) { for (Vulnerability vuln : scanResult.getVulnerabilities()) { if (policy.getProhibitedCves().contains(vuln.getCve())) { evaluation.getViolations().add( new PolicyViolation("PROHIBITED_CVE", "Prohibited CVE found: " + vuln.getCve()) ); } } } private void checkCvssThreshold(ScanResult scanResult, PolicyEvaluation evaluation) { for (Vulnerability vuln : scanResult.getVulnerabilities()) { if (vuln.getCvssScore() >= policy.getMaxCvssScore()) { evaluation.getViolations().add( new PolicyViolation("CVSS_THRESHOLD", "Vulnerability exceeds CVSS threshold: " + vuln.getCve() + " (" + vuln.getCvssScore() + ")") ); } } } public boolean canProceedToDeployment(PolicyEvaluation evaluation) { return evaluation.isCompliant() || policy.isAllowOverride(); } } @Data public class SecurityPolicy { private String name; private String version; private int maxCritical = 0; private int maxHigh = 5; private int maxMedium = 20; private int maxLow = -1; // -1 means no limit private double maxCvssScore = 8.0; private Set<String> prohibitedCves = new HashSet<>(); private boolean allowOverride = false; private List<String> allowedExceptions = new ArrayList<>(); public static SecurityPolicy strictPolicy() { SecurityPolicy policy = new SecurityPolicy(); policy.setName("Strict Security Policy"); policy.setMaxCritical(0); policy.setMaxHigh(0); policy.setMaxMedium(5); policy.setMaxCvssScore(7.0); policy.setAllowOverride(false); return policy; } public static SecurityPolicy lenientPolicy() { SecurityPolicy policy = new SecurityPolicy(); policy.setName("Lenient Security Policy"); policy.setMaxCritical(1); policy.setMaxHigh(10); policy.setMaxMedium(50); policy.setMaxCvssScore(9.0); policy.setAllowOverride(true); return policy; } } @Data public class PolicyEvaluation { private ScanResult scanResult; private boolean compliant; private List<PolicyViolation> violations; private LocalDateTime evaluationTime; public PolicyEvaluation() { this.evaluationTime = LocalDateTime.now(); this.violations = new ArrayList<>(); } } @Data public class PolicyViolation { private String type; private String message; private String severity; public PolicyViolation(String type, String message) { this.type = type; this.message = message; this.severity = "HIGH"; } }

Dockerfile Security Best Practices

1. Secure Base Image Configuration

# BAD: Using latest tag and root user FROM openjdk:latest RUN apt-get update && apt-get install -y curl COPY . /app RUN chmod +x /app/start.sh USER root CMD ["/app/start.sh"] # GOOD: Secure Dockerfile for Java application # Use specific version and non-root user FROM eclipse-temurin:17.0.8_7-jre-jammy@sha256:a1ed6eeb1c6e... # Security scanning labels LABEL org.opencontainers.image.source="https://github.com/your-org/your-app" LABEL org.opencontainers.image.licenses="Apache-2.0" LABEL com.snyk.security.scan.enabled="true" # Install security updates RUN apt-get update && \ apt-get upgrade -y && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* # Create non-root user RUN groupadd -r appuser && useradd -r -g appuser appuser # Create application directory with proper permissions RUN mkdir -p /app && chown appuser:appuser /app # Copy application COPY --chown=appuser:appuser target/your-app.jar /app/your-app.jar COPY --chown=appuser:appuser entrypoint.sh /app/entrypoint.sh # Set working directory WORKDIR /app # Switch to non-root user USER appuser # Use exec form for CMD CMD ["/app/entrypoint.sh"] # Health check HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \ CMD curl -f http://localhost:8080/health || exit 1 # Security best practices: # 1. Use specific base image with digest # 2. Regular security updates # 3. Non-root user # 4. Minimal layers # 5. Health checks # 6. Proper file permissions

2. Multi-stage Build for Security

# Multi-stage build to reduce attack surface FROM eclipse-temurin:17.0.8_7-jdk-jammy as builder # Install build dependencies RUN apt-get update && \ apt-get install -y maven && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* WORKDIR /build COPY pom.xml . COPY src ./src # Build application RUN mvn clean package -DskipTests # Runtime stage FROM eclipse-temurin:17.0.8_7-jre-jammy@sha256:a1ed6eeb1c6e... # Security hardening RUN apt-get update && \ apt-get upgrade -y && \ apt-get install -y --no-install-recommends \ ca-certificates \ curl && \ apt-get clean && \ rm -rf /var/lib/apt/lists/* && \ groupadd -r appuser && useradd -r -g appuser appuser # Copy only built artifact from builder stage COPY --from=builder /build/target/your-app.jar /app/your-app.jar COPY --chown=appuser:appuser entrypoint.sh /app/entrypoint.sh WORKDIR /app USER appuser # Security context RUN chmod 500 entrypoint.sh && \ chmod 400 your-app.jar EXPOSE 8080 CMD ["/app/entrypoint.sh"]

3. Security-Focused Entrypoint Script

#!/bin/sh # entrypoint.sh - Secure entrypoint for Java application set -euo pipefail # Security configurations export JAVA_OPTS="${JAVA_OPTS:-} \ -Djava.security.egd=file:/dev/./urandom \ -Djava.awt.headless=true \ -Dfile.encoding=UTF-8 \ -Dspring.security.strategy=MODE_INHERITABLETHREADLOCAL" # Memory limits based on container constraints if [ -n "${JAVA_MAX_MEM:-}" ]; then JAVA_OPTS="$JAVA_OPTS -Xmx${JAVA_MAX_MEM}" fi # Security manager (optional) if [ "${ENABLE_SECURITY_MANAGER:-false}" = "true" ]; then JAVA_OPTS="$JAVA_OPTS -Djava.security.manager -Djava.security.policy=/app/security.policy" fi # Debug logging for security incidents if [ "${ENABLE_SECURITY_DEBUG:-false}" = "true" ]; then JAVA_OPTS="$JAVA_OPTS -Djava.security.debug=all" fi echo "Starting application with security options: $JAVA_OPTS" # Use exec to replace shell process with Java process exec java $JAVA_OPTS -jar /app/your-app.jar "$@"

CI/CD Integration

1. GitHub Actions Workflow

name: Docker Security Scan on: push: branches: [ main, develop ] pull_request: branches: [ main ] schedule: - cron: '0 6 * * 1' # Weekly scan jobs: security-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Set up JDK 17 uses: actions/setup-java@v3 with: java-version: '17' distribution: 'temurin' cache: 'maven' - name: Build application run: mvn clean package -DskipTests - name: Build Docker image run: | docker build -t your-app:${{ github.sha }} . docker tag your-app:${{ github.sha }} your-app:latest - name: Run Docker Scan run: | docker scan --accept-license --file ./Dockerfile \ --severity high --json your-app:${{ github.sha }} > scan-report.json - name: Analyze Scan Results run: | java -cp target/your-app.jar com.yourapp.docker.ScanAnalyzer \ --report scan-report.json \ --policy security-policy.json - name: Upload Security Report uses: actions/upload-artifact@v3 with: name: security-scan-report path: | scan-report.json policy-evaluation.json - name: Fail on Critical Vulnerabilities run: | CRITICAL_COUNT=$(jq '.summary.critical' scan-report.json) if [ "$CRITICAL_COUNT" -gt 0 ]; then echo "Critical vulnerabilities found: $CRITICAL_COUNT" exit 1 fi trivy-scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v3 - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@master with: image-ref: 'your-app:latest' format: 'sarif' output: 'trivy-results.sarif' severity: 'CRITICAL,HIGH' - name: Upload Trivy results uses: github/codeql-action/upload-sarif@v2 with: sarif_file: 'trivy-results.sarif'

2. Jenkins Pipeline

pipeline { agent any tools { maven 'Maven-3.8' jdk 'JDK17' } environment { DOCKER_SCAN_SUGGEST = 'false' } stages { stage('Build') { steps { sh 'mvn clean package -DskipTests' } } stage('Build Docker Image') { steps { script { docker.build("your-app:${env.BUILD_ID}") } } } stage('Security Scan') { steps { script { // Run Docker Scan sh ''' docker scan --json your-app:${BUILD_ID} > scan-report.json ''' // Analyze results sh ''' java -cp target/your-app.jar com.yourapp.docker.ScanAnalyzer \ --report scan-report.json \ --policy strict-policy.json ''' // Check for policy violations def scanResult = readJSON file: 'scan-report.json' def criticalCount = scanResult.summary.critical if (criticalCount > 0) { error "Found ${criticalCount} critical vulnerabilities. Build failed." } } } } stage('Push to Registry') { when { expression { currentBuild.result == null || currentBuild.result == 'SUCCESS' } } steps { script { docker.withRegistry('https://registry.yourcompany.com', 'docker-credentials') { docker.image("your-app:${env.BUILD_ID}").push() docker.image("your-app:${env.BUILD_ID}").push('latest') } } } } } post { always { publishHTML([ allowMissing: false, alwaysLinkToLastBuild: true, keepAll: true, reportDir: '', reportFiles: 'scan-report.html', reportName: 'Docker Security Scan Report' ]) emailext ( subject: "Docker Security Scan: ${env.JOB_NAME} - Build ${env.BUILD_NUMBER}", body: """ Security scan completed for ${env.JOB_NAME} Build: ${env.BUILD_URL} Scan Report: ${env.BUILD_URL}security-scan/ """, to: '[email protected]' ) } failure { slackSend( channel: '#security-alerts', message: "Security scan failed for ${env.JOB_NAME}. Check ${env.BUILD_URL}" ) } } }

3. GitLab CI Pipeline

stages: - build - test - security-scan - deploy variables: MAVEN_OPTS: "-Dmaven.repo.local=.m2/repository" docker-security-scan: stage: security-scan image: docker:latest services: - docker:dind before_script: - apk add --no-cache openjdk11 maven - docker login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY script: - mvn clean package -DskipTests - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA . - docker scan --accept-license --json $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA > scan-report.json - docker scan --dependency-tree $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA - | if [ $(jq '.summary.critical' scan-report.json) -gt 0 ]; then echo "Critical vulnerabilities found. Failing pipeline." exit 1 fi artifacts: when: always paths: - scan-report.json reports: sast: scan-report.json only: - main - develop - merge_requests trivy-scan: stage: security-scan image: name: aquasec/trivy:0.45.1 entrypoint: [""] variables: TRIVY_USERNAME: $CI_REGISTRY_USER TRIVY_PASSWORD: $CI_REGISTRY_PASSWORD TRIVY_NON_SSL: "true" script: - trivy image --exit-code 0 --format template --template "@contrib/gitlab.tpl" --output gl-dependency-scanning-report.json $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA - trivy image --exit-code 1 --severity CRITICAL,HIGH $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA artifacts: when: always reports: dependency_scanning: gl-dependency-scanning-report.json

Advanced Scanning Features

1. Custom Vulnerability Database

@Service public class CustomVulnerabilityService { private final VulnerabilityDatabase customDatabase; private final DockerScanService dockerScanService; public EnhancedScanResult enhancedScan(String imageName) throws Exception { // Get standard Docker scan results ScanResult standardResult = dockerScanService.scanImage(imageName); // Enhance with custom vulnerability data EnhancedScanResult enhancedResult = new EnhancedScanResult(standardResult); // Add custom vulnerability checks checkCustomVulnerabilities(enhancedResult); // Check for business-specific risks checkBusinessRisks(enhancedResult); // Generate remediation advice generateRemediationAdvice(enhancedResult); return enhancedResult; } private void checkCustomVulnerabilities(EnhancedScanResult result) { for (Vulnerability vuln : result.getVulnerabilities()) { CustomVulnerabilityInfo customInfo = customDatabase.findByCve(vuln.getCve()); if (customInfo != null) { vuln.setCustomRiskScore(customInfo.getRiskScore()); vuln.setBusinessImpact(customInfo.getBusinessImpact()); vuln.setRemediationDeadline(customInfo.getRemediationDeadline()); } } } private void checkBusinessRisks(EnhancedScanResult result) { // Check for dependencies with known business risks List<BusinessRisk> businessRisks = new ArrayList<>(); for (Vulnerability vuln : result.getVulnerabilities()) { if (isHighBusinessRisk(vuln)) { businessRisks.add(createBusinessRisk(vuln)); } } result.setBusinessRisks(businessRisks); } private boolean isHighBusinessRisk(Vulnerability vuln) { return vuln.getCvssScore() >= 7.0 || "critical".equals(vuln.getSeverity()) || isInProductionCriticalPath(vuln.getPackageName()); } private void generateRemediationAdvice(EnhancedScanResult result) { List<RemediationAdvice> adviceList = new ArrayList<>(); for (Vulnerability vuln : result.getVulnerabilities()) { if (vuln.getFixedIn() != null && !vuln.getFixedIn().isEmpty()) { RemediationAdvice advice = new RemediationAdvice(); advice.setVulnerabilityId(vuln.getId()); advice.setPackageName(vuln.getPackageName()); advice.setCurrentVersion(vuln.getVersion()); advice.setFixedVersion(vuln.getFixedIn()); advice.setAction(generateAction(vuln)); advice.setPriority(calculatePriority(vuln)); adviceList.add(advice); } } result.setRemediationAdvice(adviceList); } } @Data public class EnhancedScanResult extends ScanResult { private List<BusinessRisk> businessRisks; private List<RemediationAdvice> remediationAdvice; private ComplianceStatus complianceStatus; public EnhancedScanResult(ScanResult baseResult) { this.setImageName(baseResult.getImageName()); this.setScanTimestamp(baseResult.getScanTimestamp()); this.setVulnerabilities(baseResult.getVulnerabilities()); this.setSummary(baseResult.getSummary()); this.businessRisks = new ArrayList<>(); this.remediationAdvice = new ArrayList<>(); } } @Data public class BusinessRisk { private String vulnerabilityId; private String riskDescription; private String businessImpact; private String mitigationStrategy; private String owner; } @Data public class RemediationAdvice { private String vulnerabilityId; private String packageName; private String currentVersion; private String fixedVersion; private String action; private String priority; }

2. Historical Scan Analysis

@Service public class ScanHistoryService { private final ScanResultRepository repository; public TrendAnalysis analyzeVulnerabilityTrends(String imageName, Duration period) { LocalDateTime endDate = LocalDateTime.now(); LocalDateTime startDate = endDate.minus(period); List<ScanResult> historicalScans = repository.findByImageNameAndDateRange(imageName, startDate, endDate); TrendAnalysis analysis = new TrendAnalysis(); analysis.setImageName(imageName); analysis.setPeriod(period); analysis.setScanCount(historicalScans.size()); // Calculate trends calculateVulnerabilityTrends(analysis, historicalScans); calculateRemediationEfficiency(analysis, historicalScans); calculateRiskScoreTrends(analysis, historicalScans); return analysis; } private void calculateVulnerabilityTrends(TrendAnalysis analysis, List<ScanResult> scans) { if (scans.size() < 2) return; ScanResult oldest = scans.get(0); ScanResult newest = scans.get(scans.size() - 1); analysis.setCriticalTrend(newest.getSummary().getCritical() - oldest.getSummary().getCritical()); analysis.setHighTrend(newest.getSummary().getHigh() - oldest.getSummary().getHigh()); analysis.setTotalTrend(newest.getSummary().getTotal() - oldest.getSummary().getTotal()); } public ComplianceReport generateComplianceReport(String imageName) { List<ScanResult> recentScans = repository.findTop10ByImageNameOrderByScanTimestampDesc(imageName); ComplianceReport report = new ComplianceReport(); report.setImageName(imageName); report.setGeneratedDate(LocalDateTime.now()); if (!recentScans.isEmpty()) { ScanResult latest = recentScans.get(0); report.setLatestScan(latest); report.setCompliant(isCompliant(latest)); report.setDaysSinceLastScan( Duration.between(latest.getScanTimestamp(), LocalDateTime.now()).toDays()); } report.setTrendAnalysis(analyzeVulnerabilityTrends(imageName, Duration.ofDays(30))); return report; } } @Data public class TrendAnalysis { private String imageName; private Duration period; private int scanCount; private int criticalTrend; private int highTrend; private int totalTrend; private double remediationEfficiency; private double riskScoreTrend; private List<String> recommendations; } @Data public class ComplianceReport { private String imageName; private LocalDateTime generatedDate; private ScanResult latestScan; private boolean compliant; private long daysSinceLastScan; private TrendAnalysis trendAnalysis; private List<PolicyViolation> violations; }

Remediation Automation

1. Automated Fix Suggestions

@Service public class RemediationService { private final DockerfileService dockerfileService; private final DependencyUpdateService dependencyService; public RemediationPlan generateRemediationPlan(ScanResult scanResult) { RemediationPlan plan = new RemediationPlan(); plan.setGeneratedDate(LocalDateTime.now()); plan.setImageName(scanResult.getImageName()); List<RemediationAction> actions = new ArrayList<>(); for (Vulnerability vuln : scanResult.getVulnerabilities()) { if (vuln.getFixedIn() != null && !vuln.getFixedIn().isEmpty()) { RemediationAction action = createRemediationAction(vuln); actions.add(action); } } // Sort by priority actions.sort(Comparator.comparing(RemediationAction::getPriority).reversed()); plan.setActions(actions); plan.setEstimatedEffort(calculateEffort(actions)); return plan; } private RemediationAction createRemediationAction(Vulnerability vuln) { RemediationAction action = new RemediationAction(); action.setVulnerabilityId(vuln.getId()); action.setPackageName(vuln.getPackageName()); action.setCurrentVersion(vuln.getVersion()); action.setTargetVersion(vuln.getFixedIn()); action.setSeverity(vuln.getSeverity()); action.setPriority(calculatePriority(vuln)); action.setActionType(determineActionType(vuln)); action.setInstructions(generateInstructions(vuln)); return action; } private ActionType determineActionType(Vulnerability vuln) { if (vuln.getPackageName().startsWith("base-image")) { return ActionType.BASE_IMAGE_UPDATE; } else if (isApplicationDependency(vuln.getPackageName())) { return ActionType.DEPENDENCY_UPDATE; } else { return ActionType.SYSTEM_PACKAGE_UPDATE; } } private String generateInstructions(Vulnerability vuln) { switch (determineActionType(vuln)) { case BASE_IMAGE_UPDATE: return "Update base image in Dockerfile to a secure version"; case DEPENDENCY_UPDATE: return String.format("Update %s from %s to %s in pom.xml", vuln.getPackageName(), vuln.getVersion(), vuln.getFixedIn()); case SYSTEM_PACKAGE_UPDATE: return String.format("Update system package %s in Dockerfile", vuln.getPackageName()); default: return "Manual remediation required"; } } public void applyRemediation(RemediationAction action) throws Exception { switch (action.getActionType()) { case BASE_IMAGE_UPDATE: dockerfileService.updateBaseImage(action.getTargetVersion()); break; case DEPENDENCY_UPDATE: dependencyService.updateDependency( action.getPackageName(), action.getTargetVersion()); break; case SYSTEM_PACKAGE_UPDATE: dockerfileService.updateSystemPackage( action.getPackageName(), action.getTargetVersion()); break; } } } @Data public class RemediationPlan { private String imageName; private LocalDateTime generatedDate; private List<RemediationAction> actions; private String estimatedEffort; private List<String> prerequisites; } @Data public class RemediationAction { private String vulnerabilityId; private String packageName; private String currentVersion; private String targetVersion; private String severity; private int priority; private ActionType actionType; private String instructions; private boolean automated; } public enum ActionType { BASE_IMAGE_UPDATE, DEPENDENCY_UPDATE, SYSTEM_PACKAGE_UPDATE, CONFIGURATION_CHANGE, MANUAL_REVIEW }

Best Practices

1. Security Scanning Checklist

public class DockerScanChecklist { public static final List<String> SECURITY_CHECKS = Arrays.asList( "1. Use specific base image tags with digests", "2. Regularly update base images", "3. Run as non-root user", "4. Use multi-stage builds", "5. Scan images in CI/CD pipeline", "6. Implement security policies", "7. Monitor for new vulnerabilities", "8. Automate remediation where possible", "9. Maintain scan history and trends", "10. Train developers on secure container practices" ); public static ScanConfiguration secureConfiguration() { ScanConfiguration config = new ScanConfiguration(); config.setSeverityThreshold("high"); config.setDependencyTree(true); config.setExcludeBase(false); config.setJsonOutput(true); config.setFailOnCritical(true); return config; } }

2. Continuous Monitoring

@Service public class ContinuousMonitoringService { @Scheduled(cron = "0 0 6 * * *") // Daily at 6 AM public void dailySecurityScan() { List<String> productionImages = getProductionImages(); for (String image : productionImages) { try { ScanResult result = dockerScanService.scanImage(image); PolicyEvaluation evaluation = policyEngine.evaluateScanResult(result); if (!evaluation.isCompliant()) { sendSecurityAlert(image, evaluation); } // Store results for trending scanHistoryService.storeScanResult(result); } catch (Exception e) { logger.error("Failed to scan image: {}", image, e); } } } private void sendSecurityAlert(String image, PolicyEvaluation evaluation) { SecurityAlert alert = new SecurityAlert(); alert.setImageName(image); alert.setEvaluation(evaluation); alert.setGeneratedAt(LocalDateTime.now()); alert.setSeverity(calculateAlertSeverity(evaluation)); // Send to security team alertService.sendAlert(alert); // Create JIRA ticket for critical issues if (alert.getSeverity() == AlertSeverity.CRITICAL) { jiraService.createSecurityTicket(alert); } } }

Conclusion

Docker Scan Plugin integration provides:

Comprehensive vulnerability scanning for container images
Policy-based security enforcement in CI/CD pipelines
Automated remediation guidance and fix suggestions
Historical trend analysis for security posture
Continuous monitoring of production images

By implementing the patterns and configurations shown above, you can establish a robust container security practice that integrates seamlessly with your Java development workflow, ensuring secure container deployments and proactive vulnerability management.

Secure Java Supply Chain, Minimal Containers & Runtime Security (Alpine, Distroless, Signing, SBOM & Kubernetes Controls)

https://macronepal.com/blog/alpine-linux-security-in-java-complete-guide/
Explains how Alpine Linux is used as a lightweight base for Java containers to reduce image size and attack surface, while discussing tradeoffs like musl compatibility, CVE handling, and additional hardening requirements for production security.

https://macronepal.com/blog/the-minimalists-approach-building-ultra-secure-java-applications-with-scratch-base-images/
Explains using scratch base images for Java applications to create extremely minimal containers with almost zero attack surface, where only the compiled Java application and runtime dependencies exist.

https://macronepal.com/blog/distroless-containers-in-java-minimal-secure-containers-for-jvm-applications/
Explains distroless Java containers that remove shells, package managers, and unnecessary OS tools, significantly reducing vulnerabilities while improving security posture for JVM workloads.

https://macronepal.com/blog/revolutionizing-container-security-implementing-chainguard-images-for-java-applications/
Explains Chainguard images for Java, which are secure-by-default, CVE-minimized container images with SBOMs and cryptographic signing, designed for modern supply-chain security.

https://macronepal.com/blog/seccomp-filtering-in-java-comprehensive-security-sandboxing/
Explains seccomp syscall filtering in Linux to restrict what system calls Java applications can make, reducing the impact of exploits by limiting kernel-level access.

https://macronepal.com/blog/in-toto-attestations-in-java/
Explains in-toto framework integration in Java to create cryptographically verifiable attestations across the software supply chain, ensuring every build step is trusted and auditable.

https://macronepal.com/blog/fulcio-integration-in-java-code-signing-certificate-infrastructure/
Explains Fulcio integration for Java, which issues short-lived certificates for code signing in a zero-trust supply chain, enabling secure identity-based signing of artifacts.

https://macronepal.com/blog/tekton-supply-chain-in-java-comprehensive-ci-cd-pipeline-implementation/
Explains using Tekton CI/CD pipelines for Java applications to automate secure builds, testing, signing, and deployment with supply-chain security controls built in.

https://macronepal.com/blog/slsa-provenance-in-java-complete-guide-to-supply-chain-security-2/
Explains SLSA (Supply-chain Levels for Software Artifacts) provenance in Java builds, ensuring traceability of how software is built, from source code to final container image.

https://macronepal.com/blog/notary-project-in-java-complete-implementation-guide/
Explains the Notary Project for Java container security, enabling cryptographic signing and verification of container images and artifacts to prevent tampering in deployment pipelines.