cs

Last updated: Oct 27, 2026

cs is Fluid Attacks' native binary for container scanning. It scans your Docker images and identifies vulnerabilities. Different from the Docker-based scanners, cs is a single self-contained binary that runs without Docker.

Installation

Linux and macOS

Run the one-line installer:

curl -fsSL https://public.fluidattacks.com/cs/install.sh | sh

This installs the cs binary to /usr/local/bin by default.

Verify the installation

cs --version

Quick scan

To scan a public container without a configuration file:

cs scan alpine:3.17

The scanner shows the findings directly in the terminal. Use --strict to exit with code 1 when the scanner finds vulnerabilities. This is useful to block CI/CD pipelines:

cs scan --strict alpine:3.17

Scan with a configuration file

For more control of paths, output format, and scan behavior, give a YAML configuration file with --config:

cs scan --config cs-config.yaml

Authenticate (optional)

By default, cs runs without authentication. If you want, you can authenticate to attribute the runs to your Fluid Attacks group.

If you run cs on your own machine, you do not have to use a Group token. Run cs login one time to sign in through your browser. You do not have to keep a secret.

In other conditions, authenticate with the Group token of your group, in one of these ways:

• Long-lived secret: set the INTEGRATES_API_TOKEN environment variable to a Group token. Get it from Organization → Groups → GroupName → DevSecOps → Manage token in the platform.
• Short-lived, from OIDC: this method is for systems that can issue OpenID Connect tokens (CI/CD, AWS, GCP, Kubernetes, and more). Use --group <your-group>, and cs gets a token for each run with no stored secret. On GitHub Actions, cs gets the token automatically. On other systems, give the token as the INTEGRATES_OIDC_TOKEN environment variable.

If the two tokens are available, the scanner uses the stored secret.

For the full guide, read Authentication. It includes the OIDC federation setup.

The scanner uses the token only to identify the caller. It does not show the token or write it to logs.

Common scenarios

Scan multiple images

language: EN
namespace: universe
containers_sca:
  images:
    - image_uri: alpine:3.17
    - image_uri: ubuntu:latest
sbom:
  output:
    name: test/fluid-sbom
    format: fluid-json
output:
  file_path: test/fluid-sarif.sarif
  format: SARIF

Block the pipeline on findings

To block a pipeline with strict mode, read Distributed binaries.

Troubleshooting

For common installation troubleshooting (permission denied, PATH issues), read Distributed binaries.

No output file is produced

Make sure that output.file_path is set in your configuration file and that the extension is .sarif or .csv. Other extensions cause an error.

Cannot use '--config' and a path together

You cannot use --config and a positional path argument together. Use only one of them:

# Config file mode
cs scan --config cs-config.yaml

# Quick scan mode
cs scan alpine:3.17