Notifications
Clear all
Topic starter
17/07/2026 4:51 pm
Hey everyone! New to Black Duck and still figuring things out. I'm running a scan on a Docker image, but I'm hitting a snag.
It looks like the scan is analyzing all the Node modules from my *build context* (like the `node_modules` in my project folder), not just what's actually in the final built image. This is causing a huge report full of false positives for dev dependencies that aren't shipped. My project's security dashboard is going wild 😅
Has anyone else dealt with this? Is there a specific flag or setting to make sure Black Duck only scans the final, layered image? I'm using the CLI integration. Any tips would be super appreciated!