Docker Usage

OpenTaint is available as a Docker image with all dependencies included. This provides a consistent, isolated environment for security analysis without requiring local installation of OpenTaint, Java, or other dependencies.

Quick Start

Pull the image and scan a project:

docker pull ghcr.io/seqra/opentaint:latest

docker run --rm \
  -v /path/to/your/project:/project \
  -v /path/to/output:/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --output /output/results.sarif /project

Pulling the Image

The OpenTaint Docker image is available from GitHub Container Registry.

Pull the latest version:

docker pull ghcr.io/seqra/opentaint:latest

Pull a specific version (recommended for reproducible builds):

docker pull ghcr.io/seqra/opentaint:v1.2.3

Available platforms: linux/amd64, linux/arm64

Running Scans

Basic Scan

Mount your project directory and an output directory, then run the scan:

docker run --rm \
  -v /path/to/your/project:/project \
  -v /path/to/output:/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --output /output/results.sarif /project

Volume mounts explained:

• /path/to/your/project:/project - Mounts your Java project as read-only
• /path/to/output:/output - Mounts a directory for the SARIF output file

Scan with Custom Ruleset

To use a custom ruleset, mount it as an additional volume:

docker run --rm \
  -v /path/to/your/project:/project \
  -v /path/to/output:/output \
  -v /path/to/rules:/rules \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --ruleset /rules/custom-rules.yaml --output /output/results.sarif /project

Scan with Increased Memory

For large projects, increase the analyzer memory:

docker run --rm \
  -v /path/to/your/project:/project \
  -v /path/to/output:/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --max-memory 16G --output /output/results.sarif /project

Scan with Configuration File

Mount a configuration file to customize behavior:

docker run --rm \
  -v /path/to/your/project:/project \
  -v /path/to/output:/output \
  -v /path/to/config.yaml:/config/opentaint.yaml \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --config /config/opentaint.yaml --output /output/results.sarif /project

Two-Step Workflow: Compile and Scan

For more control over the analysis process, you can separate the compilation and scanning steps. This is useful when you want to:

• Reuse a compiled database for multiple scans with different rulesets
• Debug compilation issues separately from scanning
• Share compiled databases across team members

Step 1: Compile the project

docker run --rm \
  -v /path/to/your/project:/project \
  -v /path/to:/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint compile --output /output/database /project

Step 2: Scan the compiled database

docker run --rm \
  -v /path/to/database:/database \
  -v /path/to/output:/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --output /output/results.sarif /database

Viewing Results

After the scan completes, the SARIF file will be available in your output directory. View the summary from the command line:

docker run --rm \
  -v /path/to/output:/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint summary --show-findings /output/results.sarif

For more ways to view and analyze results, see View and Analyze Results in the main documentation.

Image Details

• Base: Pre-configured with all OpenTaint dependencies
• Working directory: /home/opentaint
• Pre-installed components:
  • OpenTaint CLI
  • OpenTaint autobuilder and analyzer JARs
  • Security rules
  • Java runtime (Temurin JDK)

CI/CD Examples

GitHub Actions

jobs:
  security-scan:
    runs-on: ubuntu-latest
    container:
      image: ghcr.io/seqra/opentaint:latest
    steps:
      - uses: actions/checkout@v4

      - name: Run OpenTaint scan
        run: opentaint scan --output results.sarif .

      - name: Upload SARIF results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: results.sarif

Note: For a more streamlined GitHub integration, consider using the dedicated GitHub Action.

GitLab CI

opentaint-scan:
  image: ghcr.io/seqra/opentaint:latest
  script:
    - opentaint scan --output results.sarif .
  artifacts:
    paths:
      - results.sarif
    reports:
      sast: results.sarif

Note: For a more streamlined GitLab integration, see GitLab template.

Troubleshooting

Permission Issues

If you encounter permission errors when writing output files, ensure the output directory exists and is writable:

mkdir -p /path/to/output
docker run --rm \
  -v /path/to/your/project:/project \
  -v /path/to/output:/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --output /output/results.sarif /project

Verbose Logging

Enable debug logging to troubleshoot issues:

docker run --rm \
  -v /path/to/your/project:/project \
  -v /path/to/output:/output \
  ghcr.io/seqra/opentaint:latest \
  opentaint scan --debug --output /output/results.sarif /project

View Available Commands

docker run --rm ghcr.io/seqra/opentaint:latest opentaint --help
docker run --rm ghcr.io/seqra/opentaint:latest opentaint scan --help