Description
A Docker scanner for detecting secrets is designed to analyze Docker images and identify sensitive information that might be inadvertently included. Here's a breakdown of how such a scanner typically works:
Image Extraction:
The scanner pulls the Docker image and extracts its layers. Each layer represents a filesystem change, and together they form the complete filesystem of the container.
Layer Analysis:
The scanner examines each layer for files that might contain secrets. This includes configuration files, environment variables, and any other files that might store sensitive data.
Secret Prediction
The scanner uses predefined patterns (regular expressions) and ML model for secret prediction.
Reporting:
Once the scan is complete, then xGG generates report in output folder as csv