Run scans locally

You can run any of Fluid Attacks’ scanners  locally using Docker . First, to make sure you have the latest version available, you can execute the corresponding docker pull command for each scanner, for example for the SAST scanner:

docker pull fluidattacks/sast:latest

Fluid Attacks does not distribute tags according to versions. This tag will always contain the most up to date version of the tool thanks to Fluid Attacks’ CI/CD process.

Now, to execute the scanner there are multiple options available. You need to mount the container image over a directory and then call the CLI with one of the available commands . For example, to execute the SAST scanner over your project directory, you can use the following command:

docker run --rm -v /dir/to/scan:/my-dir fluidattacks/sast:latest sast scan /my-dir

replacing dir/to/scan with the actual path to your project directory. Another option would be to navigate to your project directory in your terminal and then executing:

docker run --rm -v .:/my-dir fluidattacks/sca:latest sca scan /my-dir

As shown in the previous examples, there is no need for a configuration file when running the SAST scan on a directory; in that case, the scanner executes all checks on the entire directory by default.

Another option to execute a scan is using a configuration file in YAML format. This allows you more granular control over the scanner, for example:

1. Including or excluding certain paths  for analysis.
2. Choosing which checks to execute .
3. Choosing special configuration options specific to each scanner.

To run a scanner using a configuration file, bind the configuration file to the Docker command as follows, replacing /dir/to/scan and /path/to/config.yaml with the appropriate paths for your scan directory and configuration file:

docker run --rm -v /dir/to/scan:/my-dir -v /path/to/config.yaml:/config.yaml fluidattacks/sast:latest sast scan /config.yaml

Another option would be to place the configuration file inside of your project directory and executing:

docker run --rm -v /dir/to/scan:/my-dir fluidattacks/sast:latest sast scan /my-dir/config.yaml

For more information, read Scan with a configuration file .

Troubleshooting

For solutions to common errors and issues encountered during the scanning process, consult the scanner FAQ .