cve: each image now carries an UPDATE STATUS in its title — [yours] (git.skui.io image,
fix in its repo), [update] (third-party, a NEWER image is published -> pull it), or
[upstream] (already running the latest published image -> clears only when the maintainer
rebuilds). 'Fixable' just means a patched package exists, not that you can apply it; the
status makes that explicit, and actionable findings now sort above the can't-touch ones.
config: the designated edge (SOC_EDGE, default 'traefik') is allowed to own 0.0.0.0:80/443
-- that is its job -- so it's reported as good rather than a false-positive finding.
--ignore-unfixed so unpatchable base-OS CVEs don't drown the actionable ones.
Each finding now lists packages (installed -> fixed) and how many CVEs each bump
clears, criticals first, plus a 'N of M images clean' line — a to-do list, not a
wall of CVE IDs.
A single Docker image, configured entirely by env vars (SOC_URL + SOC_TOKEN +
targets). Runs once and exits; schedule with cron. Four self-skipping sources:
- surface nmap open-port/service scan (SOC_TARGETS)
- cve Trivy HIGH/CRITICAL scan of running images (Docker socket)
- tls cert-expiry / weak-TLS / missing-headers (SOC_DOMAINS)
- config 0.0.0.0 binds, --privileged, rw docker-socket mounts (Docker socket)
Stable slugs per source so SOC Center versions/diffs/alerts. Pure stdlib;
image adds nmap + trivy. MIT, intended as a public Ethica repo.
Steffen Skui