Docker Scout vs Snyk Container on a 3GB Ubuntu 24.04 image: which vulnerabilities actually matter?

#!/bin/bash
# Docker Scout Vulnerability Scan Parser
# Version: 1.0
# Dependencies: docker-cli >= 27.1.1, jq >= 1.6
# Benchmark context: Scans ubuntu:24.04 image, outputs severity counts

set -euo pipefail  # Exit on error, undefined var, pipe failure

# Configuration
IMAGE_NAME="ubuntu:24.04"
OUTPUT_DIR="./scan-results"
SCOUT_VERSION=$(docker scout version --format "{{.Version}}" 2>/dev/null || echo "unavailable")

# Error handling: Check prerequisites
check_prerequisites() {
    echo "Checking prerequisites..."
    if ! command -v docker &> /dev/null; then
        echo "ERROR: Docker CLI not found. Install Docker Engine >= 27.1.1 first."
        exit 1
    fi
    if ! docker info &> /dev/null; then
        echo "ERROR: Docker daemon not running. Start docker service first."
        exit 1
    fi
    if ! docker scout version &> /dev/null; then
        echo "ERROR: Docker Scout not enabled. Run 'docker scout init' first."
        exit 1
    fi
    if ! command -v jq &> /dev/null; then
        echo "ERROR: jq not found. Install jq >= 1.6 for JSON parsing."
        exit 1
    fi
    mkdir -p "$OUTPUT_DIR"
    echo "Prerequisites met. Docker Scout version: $SCOUT_VERSION"
}

# Pull test image if not present
pull_image() {
    echo "Pulling image $IMAGE_NAME..."
    if ! docker image inspect "$IMAGE_NAME" &> /dev/null; then
        docker pull "$IMAGE_NAME"
    else
        echo "Image $IMAGE_NAME already present locally."
    fi
}

# Run Docker Scout scan, output JSON
run_scan() {
    echo "Running Docker Scout scan on $IMAGE_NAME..."
    local scan_output="$OUTPUT_DIR/docker-scout-$(date +%Y%m%d-%H%M%S).json"
    if ! docker scout cves "$IMAGE_NAME" --format json > "$scan_output" 2> "$OUTPUT_DIR/scout-stderr.log"; then
        echo "ERROR: Docker Scout scan failed. Check $OUTPUT_DIR/scout-stderr.log"
        exit 1
    fi
    echo "Scan complete. Output saved to $scan_output"
    echo "Scan stderr log: $OUTPUT_DIR/scout-stderr.log"
}

# Parse scan results to count vulnerabilities by severity
parse_results() {
    local latest_scan=$(ls -t "$OUTPUT_DIR"/docker-scout-*.json | head -1)
    echo "Parsing scan results from $latest_scan..."

    # Count by severity
    local critical=$(jq '[.vulnerabilities[] | select(.severity == "CRITICAL")] | length' "$latest_scan")
    local high=$(jq '[.vulnerabilities[] | select(.severity == "HIGH")] | length' "$latest_scan")
    local medium=$(jq '[.vulnerabilities[] | select(.severity == "MEDIUM")] | length' "$latest_scan")
    local low=$(jq '[.vulnerabilities[] | select(.severity == "LOW")] | length' "$latest_scan")
    local total=$((critical + high + medium + low))

    # Output summary
    echo "=== Docker Scout Scan Summary for $IMAGE_NAME ==="
    echo "Total vulnerabilities: $total"
    echo "Critical: $critical"
    echo "High: $high"
    echo "Medium: $medium"
    echo "Low: $low"
    echo "Scan tool version: $SCOUT_VERSION"
}

# Main execution
main() {
    check_prerequisites
    pull_image
    run_scan
    parse_results
}

main

#!/bin/bash
# Snyk Container Vulnerability Scan Parser
# Version: 1.0
# Dependencies: snyk-cli >= 2.8.4, jq >= 1.6, Snyk account with Container add-on
# Benchmark context: Scans ubuntu:24.04 image, outputs severity counts

set -euo pipefail

# Configuration
IMAGE_NAME="ubuntu:24.04"
OUTPUT_DIR="./scan-results"
SNYK_VERSION=$(snyk --version 2>/dev/null | head -1 || echo "unavailable")

# Error handling: Check prerequisites
check_prerequisites() {
    echo "Checking prerequisites..."
    if ! command -v snyk &> /dev/null; then
        echo "ERROR: Snyk CLI not found. Install Snyk CLI >= 2.8.4 first: npm install -g snyk"
        exit 1
    fi
    if ! snyk auth --status &> /dev/null; then
        echo "ERROR: Snyk not authenticated. Run 'snyk auth' first."
        exit 1
    fi
    if ! command -v jq &> /dev/null; then
        echo "ERROR: jq not found. Install jq >= 1.6 for JSON parsing."
        exit 1
    fi
    mkdir -p "$OUTPUT_DIR"
    echo "Prerequisites met. Snyk CLI version: $SNYK_VERSION"
}

# Pull test image if not present
pull_image() {
    echo "Pulling image $IMAGE_NAME..."
    if ! docker image inspect "$IMAGE_NAME" &> /dev/null; then
        docker pull "$IMAGE_NAME"
    else
        echo "Image $IMAGE_NAME already present locally."
    fi
}

# Run Snyk Container scan, output JSON
run_scan() {
    echo "Running Snyk Container scan on $IMAGE_NAME..."
    local scan_output="$OUTPUT_DIR/snyk-container-$(date +%Y%m%d-%H%M%S).json"
    # Snyk container test outputs JSON to stdout, stderr has logs
    if ! snyk container test "$IMAGE_NAME" --json > "$scan_output" 2> "$OUTPUT_DIR/snyk-stderr.log"; then
        # Snyk exits with non-zero code if vulns found, so we don't treat that as error
        echo "Snyk scan completed (non-zero exit code indicates vulnerabilities found)."
    fi
    # Check if output file is valid JSON
    if ! jq empty "$scan_output" &> /dev/null; then
        echo "ERROR: Snyk scan output is not valid JSON. Check $OUTPUT_DIR/snyk-stderr.log"
        exit 1
    fi
    echo "Scan complete. Output saved to $scan_output"
}

# Parse scan results to count vulnerabilities by severity
parse_results() {
    local latest_scan=$(ls -t "$OUTPUT_DIR"/snyk-container-*.json | head -1)
    echo "Parsing scan results from $latest_scan..."

    # Snyk output structure: vulnerabilities array, each has severity
    local critical=$(jq '[.vulnerabilities[] | select(.severity == "critical")] | length' "$latest_scan")
    local high=$(jq '[.vulnerabilities[] | select(.severity == "high")] | length' "$latest_scan")
    local medium=$(jq '[.vulnerabilities[] | select(.severity == "medium")] | length' "$latest_scan")
    local low=$(jq '[.vulnerabilities[] | select(.severity == "low")] | length' "$latest_scan")
    local total=$((critical + high + medium + low))

    # Output summary
    echo "=== Snyk Container Scan Summary for $IMAGE_NAME ==="
    echo "Total vulnerabilities: $total"
    echo "Critical: $critical"
    echo "High: $high"
    echo "Medium: $medium"
    echo "Low: $low"
    echo "Scan tool version: $SNYK_VERSION"
}

# Main execution
main() {
    check_prerequisites
    pull_image
    run_scan
    parse_results
}

main

#!/usr/bin/env python3
"""
Docker Scout vs Snyk Container Result Comparator
Version: 1.0
Dependencies: Python >= 3.10, pandas >= 2.0, requests >= 2.31
Benchmark context: Compares scan results from two tools for ubuntu:24.04 image
"""

import json
import os
import argparse
from typing import Dict, List, Set
import pandas as pd

# Configuration
SCOUT_SCAN_DIR = "./scan-results"
SNYK_SCAN_DIR = "./scan-results"
CVE_TRACKER_URL = "https://ubuntu-cve-tracker.github.io/ubuntu-cve-tracker/"

def load_json_file(file_path: str) -> Dict:
    """Load and validate a JSON scan result file."""
    try:
        with open(file_path, 'r') as f:
            data = json.load(f)
        if not isinstance(data, dict):
            raise ValueError("Scan result is not a valid JSON object")
        return data
    except FileNotFoundError:
        print(f"ERROR: File not found: {file_path}")
        raise
    except json.JSONDecodeError:
        print(f"ERROR: Invalid JSON in file: {file_path}")
        raise

def extract_cve_ids(scout_data: Dict, snyk_data: Dict) -> (Set[str], Set[str]):
    """Extract unique CVE IDs from both scan results."""
    # Docker Scout CVEs are in .vulnerabilities[].cve
    scout_cves = set()
    if 'vulnerabilities' in scout_data:
        for vuln in scout_data['vulnerabilities']:
            if 'cve' in vuln and vuln['cve']:
                # Handle CVE format like CVE-2024-1234
                cve_id = vuln['cve'].split()[0]  # In case of extra text
                scout_cves.add(cve_id)

    # Snyk CVEs are in .vulnerabilities[].identifiers.CVE
    snyk_cves = set()
    if 'vulnerabilities' in snyk_data:
        for vuln in snyk_data['vulnerabilities']:
            if 'identifiers' in vuln and 'CVE' in vuln['identifiers']:
                for cve in vuln['identifiers']['CVE']:
                    snyk_cves.add(cve)

    return scout_cves, snyk_cves

def find_overlaps(scout_cves: Set[str], snyk_cves: Set[str]) -> Set[str]:
    """Find CVEs present in both scan results."""
    return scout_cves.intersection(snyk_cves)

def find_unique(scout_cves: Set[str], snyk_cves: Set[str]) -> (Set[str], Set[str]):
    """Find CVEs unique to each tool."""
    unique_scout = scout_cves - snyk_cves
    unique_snyk = snyk_cves - scout_cves
    return unique_scout, unique_snyk

def validate_cves(cve_set: Set[str], max_validate: int = 100) -> float:
    """
    Validate a sample of CVEs against Ubuntu CVE tracker.
    Returns percentage of valid CVEs (not false positives).
    """
    import requests
    from requests.exceptions import RequestException

    sample = list(cve_set)[:max_validate]
    valid_count = 0
    for cve in sample:
        try:
            # Check if CVE exists in Ubuntu tracker (simplified check)
            response = requests.get(f"{CVE_TRACKER_URL}{cve}.html", timeout=5)
            if response.status_code == 200:
                valid_count += 1
        except RequestException:
            pass
    return (valid_count / len(sample)) * 100 if sample else 0.0

def main():
    parser = argparse.ArgumentParser(description="Compare Docker Scout and Snyk Container scan results")
    parser.add_argument("--scout-scan", help="Path to Docker Scout JSON scan file")
    parser.add_argument("--snyk-scan", help="Path to Snyk Container JSON scan file")
    args = parser.parse_args()

    # Load latest scan files if not provided
    scout_file = args.scout_scan
    if not scout_file:
        scout_files = [f for f in os.listdir(SCOUT_SCAN_DIR) if f.startswith("docker-scout-")]
        if not scout_files:
            print("ERROR: No Docker Scout scan files found in ./scan-results")
            exit(1)
        scout_file = os.path.join(SCOUT_SCAN_DIR, sorted(scout_files)[-1])

    snyk_file = args.snyk_scan
    if not snyk_file:
        snyk_files = [f for f in os.listdir(SNYK_SCAN_DIR) if f.startswith("snyk-container-")]
        if not snyk_files:
            print("ERROR: No Snyk Container scan files found in ./scan-results")
            exit(1)
        snyk_file = os.path.join(SNYK_SCAN_DIR, sorted(snyk_files)[-1])

    print(f"Loading Docker Scout scan: {scout_file}")
    scout_data = load_json_file(scout_file)
    print(f"Loading Snyk Container scan: {snyk_file}")
    snyk_data = load_json_file(snyk_file)

    # Extract CVEs
    scout_cves, snyk_cves = extract_cve_ids(scout_data, snyk_data)
    print(f"Docker Scout unique CVEs: {len(scout_cves)}")
    print(f"Snyk Container unique CVEs: {len(snyk_cves)}")

    # Find overlaps and uniques
    overlaps = find_overlaps(scout_cves, snyk_cves)
    unique_scout, unique_snyk = find_unique(scout_cves, snyk_cves)
    print(f"Overlapping CVEs: {len(overlaps)}")
    print(f"Unique to Docker Scout: {len(unique_scout)}")
    print(f"Unique to Snyk Container: {len(unique_snyk)}")

    # Validate samples
    print("Validating Docker Scout unique CVEs...")
    scout_valid_pct = validate_cves(unique_scout)
    print(f"Docker Scout unique CVE validity: {scout_valid_pct:.1f}%")

    print("Validating Snyk Container unique CVEs...")
    snyk_valid_pct = validate_cves(unique_snyk)
    print(f"Snyk Container unique CVE validity: {snyk_valid_pct:.1f}%")

    # Output comparison table
    print("\n=== Comparison Summary ===")
    print(pd.DataFrame({
        "Metric": ["Total CVEs", "Unique CVEs", "Valid CVEs (sample)", "False Positive Rate (sample)"],
        "Docker Scout": [len(scout_cves), len(unique_scout), f"{scout_valid_pct:.1f}%", f"{100 - scout_valid_pct:.1f}%"],
        "Snyk Container": [len(snyk_cves), len(unique_snyk), f"{snyk_valid_pct:.1f}%", f"{100 - snyk_valid_pct:.1f}%"]
    }).to_string(index=False))

if __name__ == "__main__":
    main()

docker scout cves ubuntu:24.04 --ignore CVE-2024-3094

version: v1.19.0
ignore:
  CVE-2024-3094:
    reason: "Not applicable to runtime zlib configuration"
    expires: 2024-12-31

- name: Scan container image with Docker Scout
  uses: docker/scout-action@v1
  with:
    command: cves
    image: ubuntu:24.04
    format: json
    output: scout-results.json

import json

with open("scout-results.json") as f:
    data = json.load(f)

exploitable = [v for v in data["vulnerabilities"] if v.get("cvss_score", 0) >= 9.0]
print(f"Exploitable critical vulns: {len(exploitable)}")