Using Docker

SCANOSS publishes Docker images to GitHub Container Registry (GHCR) for running scans in containerised environments. These images allow you to run SCANOSS without installing Python dependencies on the host machine and produce consistent results across Linux, macOS, and Windows hosts.

Image Details

SCANOSS Docker images are hosted on GitHub Container Registry (GHCR):

Registry: ghcr.io/scanoss/scanoss-py
Latest release: ghcr.io/scanoss/scanoss-py:latest
Specific version: ghcr.io/scanoss/scanoss-py:v1.44.0

The latest tag always points to the most recent stable release. For reproducible builds, pin to a specific version tag. View all available tags: GHCR Versions

Installation

Pull the Latest Version

docker pull ghcr.io/scanoss/scanoss-py:latest

Pull a Specific Version

# Pull v1.44.0
docker pull ghcr.io/scanoss/scanoss-py:v1.44.0

# Run v1.44.0
docker run ghcr.io/scanoss/scanoss-py:v1.44.0

Verify the Image

# Print the CLI version
docker run ghcr.io/scanoss/scanoss-py --version

# Print help text
docker run ghcr.io/scanoss/scanoss-py --help

Usage

All scan examples below mount the current working directory into the container at /scanoss. The scan path argument must reference this mount point, not a path on the host machine.

Scan the Current Directory

# Scan and display results in the terminal
docker run --rm -v "$(pwd)":/scanoss ghcr.io/scanoss/scanoss-py scan /scanoss

# Scan and write results to a file
docker run --rm -v "$(pwd)":/scanoss ghcr.io/scanoss/scanoss-py scan -o /scanoss/results.json /scanoss

Dependency Scanning

The -D / --dependencies flag includes dependency file scanning alongside source code scanning. Use --dependencies-only to skip source scanning and scan dependency files exclusively.

# Scan source code and dependency files
docker run --rm -v "$(pwd)":/scanoss ghcr.io/scanoss/scanoss-py scan --dependencies -o /scanoss/results.json /scanoss

# Scan dependency files only
docker run --rm -v "$(pwd)":/scanoss ghcr.io/scanoss/scanoss-py scan --dependencies-only -o /scanoss/results.json /scanoss

Output Formats

SCANOSS supports several output formats, including Software Bill of Materials (SBOM) standards.

# CycloneDX SBOM
docker run --rm -v "$(pwd)":/scanoss ghcr.io/scanoss/scanoss-py scan --format cyclonedx -o /scanoss/sbom.json /scanoss

# SPDX Lite SBOM
docker run --rm -v "$(pwd)":/scanoss ghcr.io/scanoss/scanoss-py scan --format spdxlite -o /scanoss/sbom.json /scanoss

# CSV report
docker run --rm -v "$(pwd)":/scanoss ghcr.io/scanoss/scanoss-py scan --format csv -o /scanoss/report.csv /scanoss

Documentation

Links

Image Details

Installation

Pull the Latest Version

Pull a Specific Version

Verify the Image

Usage

Scan the Current Directory

Dependency Scanning

Output Formats

​Image Details

​Installation

​Pull the Latest Version

​Pull a Specific Version

​Verify the Image

​Usage

​Scan the Current Directory

​Dependency Scanning

​Output Formats

Image Details

Installation

Pull the Latest Version

Pull a Specific Version

Verify the Image

Usage

Scan the Current Directory

Dependency Scanning

Output Formats