dockerdna 1.0.2__py3-none-any.whl

dockerdna/__init__.py

@@ -0,0 +1,4 @@
+"""DockerDNA — Layer-by-Layer Container Security DNA Analysis."""
+
+__version__ = "1.0.2"
+__author__ = "Sunil Gentyala, Independent Researcher"

dockerdna/ai/remediation.py

@@ -0,0 +1,142 @@
+"""
+AI-powered remediation using Anthropic Claude.
+
+Synthesises findings from ALL of DockerDNA's scanners (Dockerfile,
+compose, secrets, supply-chain) into one remediation pass and produces:
+  1. A prioritised fix plan with CIS control IDs
+  2. A rewritten Dockerfile with all issues corrected
+  3. A rewritten docker-compose with all misconfigs fixed
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Any, Optional
+
+
+def _build_context(
+    dockerfile_path: Optional[str],
+    compose_path: Optional[str],
+    dockerfile_findings: list[Any],
+    compose_findings: list[Any],
+    secret_findings: list[Any],
+    supply_chain_findings: list[Any],
+    compliance_score: float,
+) -> str:
+    parts: list[str] = []
+
+    parts.append(f"CIS Docker Benchmark compliance score: {compliance_score:.1f}%\n")
+
+    if dockerfile_findings:
+        parts.append("=== Dockerfile Findings ===")
+        for f in dockerfile_findings:
+            parts.append(f"[{f.severity}] {f.cis_id} line {f.line_number}: {f.detail}")
+
+    if compose_findings:
+        parts.append("\n=== docker-compose.yml Findings ===")
+        for f in compose_findings:
+            parts.append(f"[{f.severity}] {f.cis_id} service '{f.service}': {f.detail}")
+
+    if secret_findings:
+        parts.append("\n=== Secrets Detected ===")
+        for f in secret_findings:
+            parts.append(
+                f"[{f.severity}] {f.cis_id} {f.file} line {f.line_number}: "
+                f"{f.secret_type} ({f.detection_method})"
+            )
+
+    if supply_chain_findings:
+        parts.append("\n=== Supply Chain Risks ===")
+        for f in supply_chain_findings:
+            parts.append(
+                f"[{f.severity}] {f.image} — risk score {f.risk_score}/100: "
+                + "; ".join(f.factors)
+            )
+
+    # Append file contents (truncated)
+    if dockerfile_path and os.path.exists(dockerfile_path):
+        try:
+            content = open(dockerfile_path).read()[:3000]
+            parts.append(f"\n=== Current Dockerfile ===\n{content}")
+        except Exception:
+            pass
+
+    if compose_path and os.path.exists(compose_path):
+        try:
+            content = open(compose_path).read()[:3000]
+            parts.append(f"\n=== Current docker-compose.yml ===\n{content}")
+        except Exception:
+            pass
+
+    return "\n".join(parts)
+
+
+def get_ai_remediation(
+    dockerfile_path: Optional[str],
+    compose_path: Optional[str],
+    dockerfile_findings: list[Any],
+    compose_findings: list[Any],
+    secret_findings: list[Any],
+    supply_chain_findings: list[Any],
+    compliance_score: float,
+    model: str = "claude-sonnet-4-6",
+) -> dict:
+    """
+    Call Anthropic Claude to produce a fix plan and corrected files.
+    Requires ANTHROPIC_API_KEY environment variable.
+    """
+    try:
+        import anthropic
+    except ImportError:
+        return {"error": "anthropic package not installed. Run: pip install anthropic"}
+
+    api_key = os.environ.get("ANTHROPIC_API_KEY")
+    if not api_key:
+        return {"error": "ANTHROPIC_API_KEY environment variable not set"}
+
+    context = _build_context(
+        dockerfile_path,
+        compose_path,
+        dockerfile_findings,
+        compose_findings,
+        secret_findings,
+        supply_chain_findings,
+        compliance_score,
+    )
+
+    system_prompt = (
+        "You are a senior DevSecOps engineer specialising in Docker and container security. "
+        "You have been given a set of security findings from the DockerDNA scanner. "
+        "Your task is to:\n"
+        "1. Produce a prioritised fix plan (Critical first, then High, Medium, Low).\n"
+        "2. Write a corrected Dockerfile that resolves all Dockerfile findings.\n"
+        "3. Write a corrected docker-compose.yml that resolves all compose findings.\n"
+        "4. Provide specific advice on rotating any detected secrets.\n"
+        "Map every recommendation to its CIS Docker Benchmark control ID. "
+        "Be concise, specific, and actionable."
+    )
+
+    user_prompt = (
+        f"Here are the security findings from DockerDNA:\n\n{context}\n\n"
+        "Please provide:\n"
+        "## 1. Prioritised Fix Plan\n"
+        "## 2. Corrected Dockerfile\n"
+        "## 3. Corrected docker-compose.yml (if applicable)\n"
+        "## 4. Secret Remediation Steps\n"
+    )
+
+    client = anthropic.Anthropic(api_key=api_key)
+    message = client.messages.create(
+        model=model,
+        max_tokens=4096,
+        messages=[{"role": "user", "content": user_prompt}],
+        system=system_prompt,
+    )
+
+    response_text = message.content[0].text if message.content else ""
+    return {
+        "model": model,
+        "input_tokens": message.usage.input_tokens,
+        "output_tokens": message.usage.output_tokens,
+        "remediation": response_text,
+    }

dockerdna/cli.py

@@ -0,0 +1,182 @@
+"""
+DockerDNA CLI entry point.
+
+Usage examples:
+  dockerdna Dockerfile
+  dockerdna Dockerfile --compose docker-compose.yml
+  dockerdna --dir ./myapp --format json html sarif sbom
+  dockerdna Dockerfile --ai --threshold HIGH
+  dockerdna --dir . --format sarif --output-dir .github/security
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from dockerdna.scanner import scan
+
+
+def _print_summary(report: dict) -> None:
+    summary = report.get("summary", {})
+    by_sev = summary.get("by_severity", {})
+    meta = report.get("metadata", {})
+    print()
+    print("  ____             _             ____  _   _    _")
+    print(" |  _ \\  ___   ___| | _____ _ __| __ )| \\ | |  / \\")
+    print(" | | | |/ _ \\ / __| |/ / _ \\ '__|  _ \\|  \\| | / _ \\")
+    print(" | |_| | (_) | (__|   <  __/ |  | |_) | |\\  |/ ___ \\")
+    print(" |____/ \\___/ \\___|_|\\_\\___|_|  |____/|_| \\_/_/   \\_\\")
+    print()
+    print("  Layer-by-Layer Container Security DNA Analysis")
+    print("  github.com/sunilgentyala/DockerDNA\n")
+    print(f"  Scanned : {meta.get('scanned_path','')}")
+    if meta.get("compose_file"):
+        print(f"  Compose : {meta.get('compose_file')}")
+    print()
+    print(f"  Risk Score          : {summary.get('risk_score', 0)}/100")
+    print(f"  CIS Compliance      : {summary.get('compliance_score', 0):.1f}%")
+    print(f"  Total Findings      : {summary.get('total_findings', 0)}")
+    print()
+    print(f"  CRITICAL  {by_sev.get('CRITICAL', 0):>4}")
+    print(f"  HIGH      {by_sev.get('HIGH', 0):>4}")
+    print(f"  MEDIUM    {by_sev.get('MEDIUM', 0):>4}")
+    print(f"  LOW       {by_sev.get('LOW', 0):>4}")
+    print()
+
+    # Print critical / high findings inline
+    findings = report.get("findings", {})
+    all_findings = (
+        findings.get("secrets", [])
+        + findings.get("dockerfile", [])
+        + findings.get("compose", [])
+        + findings.get("supply_chain", [])
+    )
+    critical_high = [
+        f for f in all_findings if f.get("severity") in ("CRITICAL", "HIGH")
+    ]
+    if critical_high:
+        print("  Top findings requiring immediate attention:")
+        for f in critical_high[:10]:
+            sev = f.get("severity", "")
+            cis = f.get("cis_id", "")
+            msg = f.get("detail") or f.get("description") or str(f.get("factors", ""))
+            svc = f.get("service", "") or f.get("file", "")
+            loc = f" [{svc}]" if svc else ""
+            print(f"  [{sev}] {cis}{loc}: {msg[:90]}")
+        if len(critical_high) > 10:
+            print(f"  ... and {len(critical_high) - 10} more (see report)")
+    print()
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        prog="dockerdna",
+        description="DockerDNA — Layer-by-Layer Container Security DNA Analysis",
+    )
+    parser.add_argument(
+        "dockerfile",
+        nargs="?",
+        help="Path to Dockerfile (optional if --dir is used)",
+    )
+    parser.add_argument(
+        "--compose",
+        "-c",
+        metavar="FILE",
+        help="Path to docker-compose.yml",
+    )
+    parser.add_argument(
+        "--dir",
+        "-d",
+        metavar="DIRECTORY",
+        help="Scan an entire project directory",
+    )
+    parser.add_argument(
+        "--file",
+        "-f",
+        metavar="FILE",
+        action="append",
+        dest="extra_files",
+        help="Additional file to scan for secrets (repeatable)",
+    )
+    parser.add_argument(
+        "--format",
+        nargs="+",
+        choices=["json", "html", "sarif", "sbom"],
+        default=["json", "html"],
+        metavar="FORMAT",
+        help="Output formats: json html sarif sbom (default: json html)",
+    )
+    parser.add_argument(
+        "--output",
+        "-o",
+        default="dockerdna-results",
+        metavar="DIR",
+        help="Output directory (default: ./dockerdna-results)",
+    )
+    parser.add_argument(
+        "--ai",
+        action="store_true",
+        help="Enable AI-powered remediation via Anthropic Claude",
+    )
+    parser.add_argument(
+        "--ai-model",
+        default="claude-sonnet-4-6",
+        metavar="MODEL",
+        help="Claude model to use for AI remediation",
+    )
+    parser.add_argument(
+        "--threshold",
+        choices=["CRITICAL", "HIGH", "MEDIUM", "LOW"],
+        metavar="SEVERITY",
+        help="Exit with code 1 if findings at this severity or above are found",
+    )
+    parser.add_argument(
+        "--no-redact",
+        action="store_true",
+        help="Do not redact secret values in reports (use with caution)",
+    )
+    parser.add_argument(
+        "--verbose",
+        "-v",
+        action="store_true",
+        help="Print verbose output",
+    )
+
+    args = parser.parse_args()
+
+    if not args.dockerfile and not args.dir:
+        parser.print_help()
+        sys.exit(1)
+
+    report = scan(
+        dockerfile=args.dockerfile,
+        compose_file=args.compose,
+        extra_files=args.extra_files,
+        scan_directory=args.dir,
+        ai_remediation=args.ai,
+        ai_model=args.ai_model,
+        output_dir=args.output,
+        formats=args.format,
+        threshold=args.threshold,
+        redact_secrets=not args.no_redact,
+        verbose=args.verbose,
+    )
+
+    _print_summary(report)
+
+    out = Path(args.output)
+    if "json" in args.format:
+        print(f"  JSON   : {out / 'report.json'}")
+    if "html" in args.format:
+        print(f"  HTML   : {out / 'report.html'}")
+    if "sarif" in args.format:
+        print(f"  SARIF  : {out / 'report.sarif'}")
+    if "sbom" in args.format:
+        print(f"  SBOM   : {out / 'sbom.cyclonedx.json'}")
+    print()
+
+
+if __name__ == "__main__":
+    main()

dockerdna/reports/html.py

@@ -0,0 +1,265 @@
+"""Interactive HTML report generator."""
+
+from __future__ import annotations
+
+import html as html_lib
+from typing import Any
+
+_SEVERITY_COLORS = {
+    "CRITICAL": "#dc2626",
+    "HIGH": "#ea580c",
+    "MEDIUM": "#d97706",
+    "LOW": "#65a30d",
+}
+
+_STATUS_COLORS = {
+    "PASS": "#16a34a",
+    "FAIL": "#dc2626",
+    "NOT_CHECKED": "#6b7280",
+}
+
+
+def _esc(text: Any) -> str:
+    return html_lib.escape(str(text) if text is not None else "")
+
+
+def _badge(severity: str) -> str:
+    color = _SEVERITY_COLORS.get(severity, "#6b7280")
+    return (
+        f'<span style="background:{color};color:#fff;padding:2px 8px;'
+        f'border-radius:4px;font-size:0.75rem;font-weight:bold;">'
+        f"{_esc(severity)}</span>"
+    )
+
+
+def _status_badge(status: str) -> str:
+    color = _STATUS_COLORS.get(status, "#6b7280")
+    return (
+        f'<span style="background:{color};color:#fff;padding:2px 8px;'
+        f'border-radius:4px;font-size:0.75rem;font-weight:bold;">'
+        f"{_esc(status)}</span>"
+    )
+
+
+def _finding_rows(findings: list[Any], cols: list[tuple[str, str]]) -> str:
+    if not findings:
+        return '<tr><td colspan="100" style="text-align:center;color:#6b7280;">No findings</td></tr>'
+    rows = []
+    for f in findings:
+        cells = []
+        for attr, kind in cols:
+            val = getattr(f, attr, "")
+            if kind == "badge":
+                cells.append(f"<td>{_badge(str(val))}</td>")
+            elif kind == "code":
+                cells.append(f"<td><code>{_esc(val)}</code></td>")
+            else:
+                cells.append(f"<td>{_esc(val)}</td>")
+        rows.append(f"<tr>{''.join(cells)}</tr>")
+    return "\n".join(rows)
+
+
+def generate_html(report: dict) -> str:
+    summary = report.get("summary", {})
+    risk = summary.get("risk_score", 0)
+    comp = summary.get("compliance_score", 0)
+    total = summary.get("total_findings", 0)
+    by_sev = summary.get("by_severity", {})
+
+    risk_color = (
+        "#dc2626"
+        if risk >= 70
+        else "#ea580c" if risk >= 40 else "#d97706" if risk >= 20 else "#16a34a"
+    )
+
+    meta = report.get("metadata", {})
+
+    # ------------------------------------------------------------------ #
+    # Findings tables
+    # ------------------------------------------------------------------ #
+
+    def _table(
+        title: str, findings: list[dict], columns: list[tuple[str, str, str]]
+    ) -> str:
+        headers = "".join(f"<th>{h}</th>" for h, _, _ in columns)
+        rows_html = ""
+        if not findings:
+            rows_html = f'<tr><td colspan="{len(columns)}" style="text-align:center;color:#6b7280;">No findings</td></tr>'
+        else:
+            for f in findings:
+                cells = []
+                for _, key, kind in columns:
+                    val = f.get(key, "")
+                    if kind == "badge":
+                        cells.append(f"<td>{_badge(str(val))}</td>")
+                    elif kind == "code":
+                        cells.append(
+                            f'<td><code style="font-size:0.8rem;">{_esc(val)}</code></td>'
+                        )
+                    else:
+                        cells.append(f"<td>{_esc(val)}</td>")
+                rows_html += f"<tr>{''.join(cells)}</tr>\n"
+
+        return f"""
+        <h3>{_esc(title)}</h3>
+        <div style="overflow-x:auto;">
+        <table>
+          <thead><tr>{headers}</tr></thead>
+          <tbody>{rows_html}</tbody>
+        </table>
+        </div>"""
+
+    df_findings = report.get("findings", {}).get("dockerfile", [])
+    cf_findings = report.get("findings", {}).get("compose", [])
+    sec_findings = report.get("findings", {}).get("secrets", [])
+    sc_findings = report.get("findings", {}).get("supply_chain", [])
+
+    df_table = _table(
+        "Dockerfile Findings",
+        df_findings,
+        [
+            ("Severity", "severity", "badge"),
+            ("Line", "line", "text"),
+            ("CIS ID", "cis_id", "code"),
+            ("Title", "title", "text"),
+            ("Detail", "detail", "text"),
+            ("Stage", "stage", "text"),
+        ],
+    )
+
+    cf_table = _table(
+        "docker-compose.yml Findings",
+        cf_findings,
+        [
+            ("Severity", "severity", "badge"),
+            ("Service", "service", "text"),
+            ("CIS ID", "cis_id", "code"),
+            ("Title", "title", "text"),
+            ("Detail", "detail", "text"),
+        ],
+    )
+
+    sec_table = _table(
+        "Secrets Detected",
+        sec_findings,
+        [
+            ("Severity", "severity", "badge"),
+            ("File", "file", "text"),
+            ("Line", "line", "text"),
+            ("CIS ID", "cis_id", "code"),
+            ("Type", "type", "text"),
+            ("Method", "detection", "text"),
+            ("Value", "matched_value", "code"),
+        ],
+    )
+
+    sc_table = _table(
+        "Supply Chain Analysis",
+        sc_findings,
+        [
+            ("Severity", "severity", "badge"),
+            ("Image", "image", "code"),
+            ("Stage", "stage", "text"),
+            ("Risk Score", "risk_score", "text"),
+            ("Factors", "factors", "text"),
+        ],
+    )
+
+    # Compliance table
+    compliance = report.get("compliance", {})
+    c_summary = compliance.get("summary", {})
+    c_controls = compliance.get("controls", [])
+    c_rows = ""
+    for ctrl in c_controls:
+        c_rows += (
+            f"<tr>"
+            f"<td><code>{_esc(ctrl.get('id',''))}</code></td>"
+            f"<td>{_esc(ctrl.get('title',''))}</td>"
+            f"<td>{_status_badge(ctrl.get('status',''))}</td>"
+            f"<td>{_badge(ctrl.get('severity',''))}</td>"
+            f"<td>{_esc(ctrl.get('findings_count',''))}</td>"
+            f"</tr>\n"
+        )
+    comp_table = f"""
+    <h3>CIS Docker Benchmark v1.6 Compliance</h3>
+    <p>Controls passed: {c_summary.get('passed',0)} /
+       {c_summary.get('total_controls',0)} &nbsp;|&nbsp;
+       Score: <strong>{c_summary.get('compliance_score',0):.1f}%</strong></p>
+    <div style="overflow-x:auto;">
+    <table>
+      <thead><tr><th>ID</th><th>Title</th><th>Status</th><th>Severity</th><th>Findings</th></tr></thead>
+      <tbody>{c_rows}</tbody>
+    </table>
+    </div>"""
+
+    return f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <title>DockerDNA Security Report</title>
+  <style>
+    body {{font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;margin:0;background:#f9fafb;color:#111827;}}
+    .header {{background:#1e293b;color:#f8fafc;padding:24px 40px;}}
+    .header h1 {{margin:0;font-size:1.8rem;}}
+    .header p  {{margin:4px 0 0;opacity:.7;}}
+    .container {{max-width:1200px;margin:0 auto;padding:24px 40px;}}
+    .cards {{display:flex;gap:16px;flex-wrap:wrap;margin-bottom:32px;}}
+    .card {{background:#fff;border-radius:8px;padding:20px 28px;box-shadow:0 1px 3px rgba(0,0,0,.1);min-width:160px;}}
+    .card .value {{font-size:2.2rem;font-weight:700;}}
+    .card .label {{font-size:.85rem;color:#6b7280;margin-top:4px;}}
+    table {{width:100%;border-collapse:collapse;background:#fff;border-radius:8px;overflow:hidden;
+            box-shadow:0 1px 3px rgba(0,0,0,.1);margin-bottom:32px;}}
+    th {{background:#1e293b;color:#f8fafc;padding:10px 14px;text-align:left;font-size:.85rem;}}
+    td {{padding:9px 14px;border-bottom:1px solid #e5e7eb;font-size:.9rem;vertical-align:top;}}
+    tr:hover td {{background:#f9fafb;}}
+    h3 {{margin:32px 0 12px;color:#1e293b;}}
+    code {{background:#f1f5f9;padding:2px 6px;border-radius:3px;font-size:.85rem;}}
+  </style>
+</head>
+<body>
+  <div class="header">
+    <h1>&#x1F9EC; DockerDNA Security Report</h1>
+    <p>Generated: {_esc(report.get('timestamp',''))} &nbsp;|&nbsp; {_esc(meta.get('scanned_path',''))}</p>
+  </div>
+  <div class="container">
+
+    <div class="cards">
+      <div class="card">
+        <div class="value" style="color:{risk_color};">{risk}</div>
+        <div class="label">Risk Score (0-100)</div>
+      </div>
+      <div class="card">
+        <div class="value" style="color:#2563eb;">{comp:.0f}%</div>
+        <div class="label">CIS Compliance</div>
+      </div>
+      <div class="card">
+        <div class="value" style="color:#dc2626;">{by_sev.get('CRITICAL',0)}</div>
+        <div class="label">Critical</div>
+      </div>
+      <div class="card">
+        <div class="value" style="color:#ea580c;">{by_sev.get('HIGH',0)}</div>
+        <div class="label">High</div>
+      </div>
+      <div class="card">
+        <div class="value" style="color:#d97706;">{by_sev.get('MEDIUM',0)}</div>
+        <div class="label">Medium</div>
+      </div>
+      <div class="card">
+        <div class="value" style="color:#65a30d;">{by_sev.get('LOW',0)}</div>
+        <div class="label">Low</div>
+      </div>
+      <div class="card">
+        <div class="value">{total}</div>
+        <div class="label">Total Findings</div>
+      </div>
+    </div>
+
+    {df_table}
+    {cf_table}
+    {sec_table}
+    {sc_table}
+    {comp_table}
+
+  </div>
+</body>
+</html>"""

dockerdna/reports/json_report.py

@@ -0,0 +1,71 @@
+"""JSON report assembler."""
+
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from typing import Any
+
+
+def generate_json_report(
+    dockerfile_findings: list[Any],
+    compose_findings: list[Any],
+    secret_findings: list[Any],
+    supply_chain_findings: list[Any],
+    compliance_report: Any,
+    sbom: dict,
+    metadata: dict,
+) -> dict:
+
+    def _count(findings: list[Any]) -> dict:
+        counts: dict[str, int] = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0}
+        for f in findings:
+            sev = getattr(f, "severity", "LOW")
+            counts[sev] = counts.get(sev, 0) + 1
+        return counts
+
+    df_counts = _count(dockerfile_findings)
+    cf_counts = _count(compose_findings)
+    sf_counts = _count(secret_findings)
+    sc_counts = _count(supply_chain_findings)
+
+    total_critical = sum(
+        c["CRITICAL"] for c in [df_counts, cf_counts, sf_counts, sc_counts]
+    )
+    total_high = sum(c["HIGH"] for c in [df_counts, cf_counts, sf_counts, sc_counts])
+
+    risk_score = min(100, total_critical * 15 + total_high * 5)
+
+    return {
+        "tool": "DockerDNA",
+        "version": "1.0.2",
+        "timestamp": datetime.now(timezone.utc).isoformat(),
+        "metadata": metadata,
+        "summary": {
+            "risk_score": risk_score,
+            "compliance_score": compliance_report.score if compliance_report else 0,
+            "total_findings": (
+                len(dockerfile_findings)
+                + len(compose_findings)
+                + len(secret_findings)
+                + len(supply_chain_findings)
+            ),
+            "by_severity": {
+                "CRITICAL": total_critical,
+                "HIGH": total_high,
+                "MEDIUM": sum(
+                    c["MEDIUM"] for c in [df_counts, cf_counts, sf_counts, sc_counts]
+                ),
+                "LOW": sum(
+                    c["LOW"] for c in [df_counts, cf_counts, sf_counts, sc_counts]
+                ),
+            },
+        },
+        "findings": {
+            "dockerfile": [f.to_dict() for f in dockerfile_findings],
+            "compose": [f.to_dict() for f in compose_findings],
+            "secrets": [f.to_dict() for f in secret_findings],
+            "supply_chain": [f.to_dict() for f in supply_chain_findings],
+        },
+        "compliance": compliance_report.to_dict() if compliance_report else {},
+        "sbom": sbom,
+    }