Don't rely on Docker for image scan (v2.0.0-beta2)

[userbradley]

Howdy!

I have tried to use this, however scanning images seems to rely on the Docker CLI/engine being installed.

As a company, we do not use Docker on computers, instead use podman.

Is there a plan to support non-docker container runtimes in the future?

I am happy to test any changes made!

[cuixq]

@another-rex

[another-rex]

Good news! Container scanning with OSV-Scanner v2 does not rely on docker being installed. The default osv-scanner scan image does invoke docker, but this only acts as a helper script for the following:

docker save /tmp/image.tar && osv-scanner scan image --archive /tmp/image.tar

So you can just run

podman save --format=docker-archive my-image:latest > my-image.tar
osv-scanner scan image --archive ./my-image.tar

to perform the scan.

See the documentation for more details: https://google.github.io/osv-scanner/usage/scan-image

v2 is still in beta, you can download the beta release on our https://github.com/google/osv-scanner/releases page. We are expecting to do a full release some time near the end of this month.

Let me know if this does/doesn't work for you!