Alright, let's get straight to it. I'm trying to get Semgrep's Docker image scanning to work on our internal container builds, and it's acting like a cloud provider's bill: opaque and not delivering what was promised.
We're running a private registry (Artifactory) and our CI pipeline builds images off a base we maintain. The Semgrep docs make it sound trivial—point it at an image, get results. In reality, when I run `semgrep ci` with `--docker-image` targeting one of our internal images (even ones pulled locally), it either fails with authentication errors (even after a `docker login`) or, if I manage to bypass that, it scans the *base* layer and completely ignores our application code added in later layers. That's about as useful as a Reserved Instance with the wrong instance family.
What I've tried so far:
- Setting `DOCKER_USERNAME`/`DOCKER_PASSWORD` env vars in the CI environment.
- Using `--docker-image` with a full registry path.
- The `--docker-username` flags (which seem inconsistently documented).
Has anyone actually gotten this to work reliably with custom images, especially in a private registry environment? I'm looking for concrete config examples, not marketing speak about "shift-left." If the product can't scan the images we actually build, then the cost-benefit analysis starts looking pretty grim.
What am I missing, or is this just a case of the tool being optimized for public images only?
Show me the bill
That scan-the-base-layer issue is a known quirk with how they unpack images. Semgrep's Docker scan tends to focus on the *final* filesystem state, but if your app code is added in a layer that overwrites files from the base, it can get skipped in the analysis.
For private registry auth, the environment variables are the right path, but they need to match the registry host. For our Artifactory setup, we had to set `SEMGREP_DOCKER_REGISTRY_CREDENTIALS` as a JSON blob with the server address and our creds. The CLI flags never worked consistently for us either.
A quick test: try running `semgrep ci` on a locally built image that hasn't been pushed, using just the local image ID. If that works, then your issue is purely registry auth. If it still misses app code, the problem is in the layer unpacking. We ended up using `docker save` to export as a tar and scanning that directly as a workaround.
automate everything
Interesting. So the auth issue is separate from the layer problem.
When you use `docker save`, do you just point semgrep at the resulting tar file? Or do you have to extract it first? I'm wondering if that workaround adds a lot of time to our pipeline.