Docker in CI/CD

Last updated: Jul 21, 2026

Fluid Attacks' Docker containers work on any CI/CD provider that supports running Docker images.

To attribute each scan to your Fluid Attacks group, pass --group inside the docker run command and supply your Group token as an environment variable — short-lived via OIDC (INTEGRATES_OIDC_TOKEN) or a long-lived INTEGRATES_API_TOKEN secret. See Authentication for setup.

GitHub Actions

For SAST, SCA, Secret Scan, DAST, and CI Gate, use the dedicated GitHub Actions instead of the Docker-based approach.

For scanners without a dedicated GitHub Action (MAST, CSPM), use the Docker image directly in a workflow step:

# .github/workflows/apk.yml
name: APK Analysis
on: [push, pull_request]
jobs:
  apkScan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f095bcc56b7c2baf48f3ac70d6d6782f4f553222
      - uses: docker://docker.io/fluidattacks/apk:latest
        name: apkAnalysis
        with:
          args: apk scan myapp.apk

Replace the container URI and command with the ones for your scanner.

GitLab CI

# .gitlab-ci.yml
machineStandalone:
  image: docker.io/fluidattacks/sast:latest
  script:
    - sast scan /dir/to/scan

Travis CI

# .travis.yml
services:
  - docker
before_install:
  - docker pull fluidattacks/sast:latest
  - docker run fluidattacks/sast:latest /bin/bash -c "cd /dir/to/scan"
script:
  - sast scan .

Bitbucket Pipelines

Bitbucket Pipelines requires Docker in Docker (DinD):

# bitbucket-pipelines.yml
pipelines:
  default:
    - step:
        name: Fluid-Attacks-SAST-Scanner
        services:
          - docker
        script:
          - docker pull fluidattacks/sast:latest
          - docker run -v "$PWD":/src:ro fluidattacks/sast:latest sast scan /src/config.yaml

Other providers

The Docker-based scanners can run on any CI/CD provider that supports Docker images. Replace the container image and command in the examples above with those for your chosen scanner. Refer to each provider's documentation for instructions on running Docker containers in their pipelines.