PatchFlow Image Scanner

A native Go, OCI-first, digest-first, layer-aware container image scanner. It resolves an image, reconstructs its layered filesystem, detects the OS, catalogs OS and language packages with layer attribution, matches them against a local vulnerability database, and emits confidence-ranked findings plus a CycloneDX 1.6 SBOM.

What it does

• Package cataloging — OS packages (Alpine, Debian, Ubuntu) and language packages (npm, PyPI, Maven, Go, Cargo) with layer attribution
• Vulnerability matching — vendor-first matching against a local SQLite DB built from OSV, Alpine SecDB, Debian Security Tracker, Ubuntu OVAL, and NVD
• Layer-blame remediation — attributes each finding to the RUN/COPY layer that introduced it and recommends a fix path
• Secret scanning — detects AWS keys, GitHub tokens, private keys, and high-entropy strings in image config and filesystem (redacted output)
• Image hardening — 14 PF-IMG-* rules (root user, missing USER, SSH exposed, sudo, world-writable paths, missing healthcheck, etc.)
• Misconfiguration scanning — 12 PF-MISC-* rules on image config
• Vulnerability delta — diff compares two image versions and reports newly introduced/resolved CVEs, package changes, and layer changes
• CycloneDX 1.6 SBOM — standards-compliant SBOM with layer provenance

Quick start

# Build
make build

# Scan an image
./patchflow-image-scanner scan alpine:3.20

# Scan with vulnerability matching
./patchflow-image-scanner scan alpine:3.20 --vulns

# Generate a CycloneDX SBOM
./patchflow-image-scanner sbom debian:bookworm-slim -o sbom.cdx.json

# Compare two image versions
./patchflow-image-scanner diff alpine:3.19 alpine:3.20 --vulns

# Explain a vulnerability
./patchflow-image-scanner explain CVE-2023-42363 --image alpine:3.20

Building the vulnerability database

Before using --vulns, build the local DB:

go run ./cmd/pf-db-builder --verbose

Set NVD_API_KEY for faster NVD imports. See CLI.md for details.

Documentation

• QUICKSTART.md — 5-minute quickstart guide
• CLI.md — full command and flag reference
• IMPLEMENTATION_PLAN.md — phase-by-phase build history and roadmap

Requirements

• Go 1.25+
• make (for build targets)
• git (for version metadata)
• Optional: NVD_API_KEY for faster vuln DB builds

License

Proprietary. See the project repository for details.