Dockle Integration Guide

Integrate Dockle with Vulnetix. Lint container images against CIS Docker benchmarks (11 checkpoints) and Dockle-specific security checks.

Install & scan

$ go install github.com/goodwithtech/dockle/cmd/dockle@latest
$ dockle --format sarif --output dockle.sarif myimage:latest

Run Dockle in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install Dockle
  run: |
    VERSION=$(curl -s https://api.github.com/repos/goodwithtech/dockle/releases/latest | grep '"tag_name"' | sed -E 's/.*"v([^"]+)".*/\1/')
    curl -L "https://github.com/goodwithtech/dockle/releases/download/v${VERSION}/dockle_${VERSION}_Linux-64bit.tar.gz" | tar xz
    sudo mv dockle /usr/local/bin/
- name: Run Dockle
  run: dockle --format sarif --output dockle.sarif myimage:latest
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: dockle
    path: dockle.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Dockle's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Dockle. Keep running it. Vulnetix sits on top of Dockle (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Dockle is strongest at its core category and also carries features in Secret Scanning, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Dockle does well

• Purpose-built CIS Docker Benchmark linter: checks how the image was built rather than what CVEs it contains, filling a gap most scanners ignore
• Detects credentials/secrets baked into image env vars and files, and flags setuid/setgid and root-user misconfigurations
• Enforces Dockerfile best practices (base-image trust, package-cache cleanup, healthcheck presence) with clear FATAL/WARN/INFO severities
• Tiny, dependency-light CLI that drops easily into CI as a fast build-hardening gate

Where Vulnetix adds to it: Dockle lints image build hygiene and CIS compliance but explicitly does no CVE scanning and no cross-domain correlation. Vulnetix ingests Dockle's misconfiguration and secret findings and merges them with container CVE, SAST, SCA, IaC and cloud results into one prioritised, deduped queue with exploit-intel, reachability, versioned VEX and SSVC policy. Dockle hardens the build; Vulnetix consolidates and prioritises its output across the whole pipeline.

No migration, no rip-and-replace. Dockle keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Dockle results in Vulnetix

Upload Dockle SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Dockle documentation ↗  ·  Source repository ↗

Wire Dockle into your CI/CD pipeline →