Help: Scan is picking up Node modules from Docker build context, not the final image.

Black Duck Reviews

Last Post by gracel 3 months ago

1 Posts

1 Users

0 Reactions

25 Views

RSS

gracel

(@gracel)

Reputable Member

Joined: 3 months ago

Posts: 227

Topic starter 17/07/2026 4:51 pm [#9222]

Hey everyone! New to Black Duck and still figuring things out. I'm running a scan on a Docker image, but I'm hitting a snag.

It looks like the scan is analyzing all the Node modules from my *build context* (like the `node_modules` in my project folder), not just what's actually in the final built image. This is causing a huge report full of false positives for dev dependencies that aren't shipped. My project's security dashboard is going wild 😅

Has anyone else dealt with this? Is there a specific flag or setting to make sure Black Duck only scans the final, layered image? I'm using the CLI integration. Any tips would be super appreciated!

Quote

Topic Tags