Docker in CI/CD

Last updated: Oct 26, 2026

Fluid Attacks' Docker containers work on all CI/CD providers that can run Docker images.

To attribute each scan to your Fluid Attacks group, use --group in the docker run command. Give your Group token as an environment variable. The token can be a short-lived token from OIDC (INTEGRATES_OIDC_TOKEN) or a long-lived INTEGRATES_API_TOKEN secret. For the setup, read Authentication.

GitHub Actions

For SAST, SCA, Secret Scan, DAST, and CI Gate, use the GitHub Actions, not the Docker containers.

For scanners without a GitHub Action (MAST, CSPM), use the Docker image directly in a workflow step:

# .github/workflows/mast.yml
name: MAST Analysis
on: [push, pull_request]
jobs:
  mastScan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@f095bcc56b7c2baf48f3ac70d6d6782f4f553222
      - uses: docker://docker.io/fluidattacks/mast:latest
        name: mastAnalysis
        with:
          args: mast scan config.yaml

Replace the container URI and command with the ones for your scanner. The MAST scanner uses a configuration file.

GitLab CI

# .gitlab-ci.yml
machineStandalone:
  image: docker.io/fluidattacks/sast:latest
  script:
    - sast scan /dir/to/scan

Travis CI

# .travis.yml
services:
  - docker
before_install:
  - docker pull fluidattacks/sast:latest
  - docker run fluidattacks/sast:latest /bin/bash -c "cd /dir/to/scan"
script:
  - sast scan .

Bitbucket Pipelines

Bitbucket Pipelines requires Docker in Docker (DinD):

# bitbucket-pipelines.yml
pipelines:
  default:
    - step:
        name: Fluid-Attacks-SAST-Scanner
        services:
          - docker
        script:
          - docker pull fluidattacks/sast:latest
          - docker run -v "$PWD":/src:ro fluidattacks/sast:latest sast scan /src/config.yaml

Other providers

The scanners in Docker containers can run on all CI/CD providers that support Docker images. In the examples above, replace the container image and command with the image and command of your scanner. For instructions about how to run Docker containers in a pipeline, read the documentation of each provider.