Docker
7 min
docker edition enterprise + open source the docker integration scans docker images for credentials and other sensitive data configuration the docker integration is configured via a local configuration file web configuration in trufflehog is not available for this source local configuration local configuration supports four authentication methods unauthenticated — for public images that don't require authentication docker keychain — uses credentials from your local docker login (docker login) basic authentication — uses a registry username and password bearer token — uses a registry bearer token images can be specified with or without a tag if no tag is provided, latest is assumed unauthenticated use this for public images that don't require registry authentication sources \ connection "@type" type googleapis com/sources docker images \ trufflesecurity/secrets unauthenticated {} name docker scanperiod 12h type source type docker verify true docker keychain use this when you've already authenticated to your registry locally with docker login the scanner will use credentials from the docker keychain sources \ connection "@type" type googleapis com/sources docker dockerkeychain true images \ trufflesecurity/secrets name docker scanperiod 12h type source type docker verify true basic authentication use this for registries that accept username and password credentials sources \ connection "@type" type googleapis com/sources docker basicauth username user password xxxxxxxxxxxxxxxxxxxxxxxxxx images \ trufflesecurity/secrets name docker scanperiod 12h type source type docker verify true bearer token use this for registries that accept bearer tokens sources \ connection "@type" type googleapis com/sources docker bearertoken xxxxxxxx images \ trufflesecurity/secrets name docker scanperiod 12h type source type docker verify true configuration options field type required description images list yes explicit list of images to scan images without a tag default to latest unauthenticated object conditional empty object indicating no authentication required for unauthenticated mode dockerkeychain boolean conditional use credentials from the local docker keychain required for keychain mode basicauth username string conditional registry username required for basic auth mode basicauth password string conditional registry password required for basic auth mode bearertoken string conditional registry bearer token required for bearer token mode capabilities feature supported scan archive files ✅ scan base64 encoded data ✅ scan binaries ✅ notes images must be listed explicitly in the images field image enumeration (e g , scanning all images in a registry or organization) is not supported only images built for the linux/amd64 platform are scanned images built for other architectures (such as linux/arm64 or windows/amd64) are not supported
