Docker

Last updated: Oct 28, 2026

Fluid Attacks provides Docker containers for security scanning. Each container bundles a scanner and its CLI. Pull and run it on any machine or CI/CD runner that has Docker.

These containers are available on Docker Hub:

Authenticate (optional)

When you authenticate, the platform attributes the scan to your Fluid Attacks group. All Fluid Attacks scanners authenticate each run with a Group token. You can give the token as a short-lived token from OpenID Connect (use --group, with nothing stored) or as a long-lived INTEGRATES_API_TOKEN secret. For scanners in Docker containers, use --group in the docker run command. Give the token to the container with -e INTEGRATES_OIDC_TOKEN or -e INTEGRATES_API_TOKEN.

For the setup, read Authentication.

Running a scanner

To make sure that you have the latest version, you can run the Docker pull command of the scanner. For example, for the SAST scanner:

docker pull fluidattacks/sast:latest

Fluid Attacks does not have a tag for each version. Because of Fluid Attacks' CI/CD process, this tag always contains the most up-to-date version of the tool.

There are different options to run the scanner. Mount the container image on a directory and then call the CLI with one of the available commands.

For example, to run the SAST scanner on your project directory, use this command:

docker run --rm -v /dir/to/scan:/my-dir fluidattacks/sast:latest sast scan /my-dir

Replace dir/to/scan with the real path to your project directory. You can also go to your project directory in your terminal and then run:

docker run --rm -v .:/my-dir fluidattacks/sca:latest sca scan /my-dir

As these examples show, you do not have to use a configuration file when you run the SAST scan on a directory. In that case, the scanner runs all checks on the full directory by default.

You can also run a scan with a configuration file in YAML format. This gives you more detailed control of the scanner. For example, you can do these things:

• Include or exclude paths for analysis
• Select the checks to run
• Set configuration options for each scanner

To run a scanner with a configuration file, bind the configuration file to the Docker command as follows. Replace /dir/to/scan and /path/to/config.yaml with the appropriate paths for your scan directory and configuration file:

docker run --rm -v /dir/to/scan:/my-dir -v /path/to/config.yaml:/config.yaml fluidattacks/sast:latest sast scan /config.yaml

You can also put the configuration file in your project directory and run:

docker run --rm -v /dir/to/scan:/my-dir fluidattacks/sast:latest sast scan /my-dir/config.yaml

For more information, read "Scan with a configuration file".

Troubleshooting

For solutions to common errors and issues during the scanning process, read the "Scanners FAQ".