Local run

Last updated: Mar 24, 2026

You can run any of Fluid Attacks' scanners locally using Docker.

First, to make sure you have the latest version available, you can execute the corresponding Docker pull command for each scanner. For example, for the SAST scanner:

docker pull fluidattacks/sast:latest

Fluid Attacks does not distribute tags according to versions. This tag will always contain the most up-to-date version of the tool thanks to Fluid Attacks' CI/CD process.

Now, to execute the scanner, there are multiple options available. You need to mount the container image over a directory and then call the CLI with one of the available commands.

For example, to execute the SAST scanner over your project directory, you can use the following command:

docker run --rm -v /dir/to/scan:/my-dir fluidattacks/sast:latest sast scan /my-dir

Replace dir/to/scan with the actual path to your project directory. Another option would be to navigate to your project directory in your terminal and then execute:

docker run --rm -v .:/my-dir fluidattacks/sca:latest sca scan /my-dir

As shown in the previous examples, there is no need for a configuration file when running the SAST scan on a directory. In that case, the scanner executes all checks on the entire directory by default.

Another option to execute a scan is using a configuration file in YAML format. This allows you more granular control over the scanner, for example:

• Including or excluding certain paths for analysis
• Choosing which checks to execute
• Choosing special configuration options specific to each scanner

To run a scanner using a configuration file, bind the configuration file to the Docker command as follows, replacing /dir/to/scan and /path/to/config.yaml with the appropriate paths for your scan directory and configuration file:

docker run --rm -v /dir/to/scan:/my-dir -v /path/to/config.yaml:/config.yaml fluidattacks/sast:latest sast scan /config.yaml

Another option would be to place the configuration file inside your project directory and execute:

docker run --rm -v /dir/to/scan:/my-dir fluidattacks/sast:latest sast scan /my-dir/config.yaml

For more information, read "Scan with a configuration file".

Troubleshooting

For solutions to common errors and issues encountered during the scanning process, consult the "Scanners FAQ".