Base
Hardened build
minimal ports, security patches applied at build time
Checkov on Ubuntu 24.04 LTS
Azure
Security
Checkov, the open source policy as code scanner that reads your infrastructure as code and reports where it breaks security and compliance policy before you deploy.
Overview
Checkov is a static analysis scanner for infrastructure as code. It parses Terraform, CloudFormation, Kubernetes, Helm, ARM, Bicep, Serverless and Dockerfiles and evaluates them against thousands of built in policies, flagging misconfigurations such as an object store with no encryption, a security group open to the whole internet, a container that runs as root or a database without backups. Each finding names the exact policy it violated and the file and line it came from, so a team can catch insecure infrastructure in review or in a pipeline rather than after it is live. It runs as a single command with no server, no database and no login: point it at a directory or a file and it prints a pass and fail report, and its exit code lets a CI job block a merge on a failing policy. Findings can be suppressed inline with a skip comment or governed centrally with a policy file, and custom policies can be added alongside the built in set.
It suits platform and security teams shifting cloud security left into code review, engineers gating infrastructure changes in CI, and anyone who wants a self hosted scanner they own inside their own cloud account.
Why the cloudimg image
Checkov has no login and no network service of its own, so what matters is that it is shipped ready to run and honest about having no credential, and cloudimg ships it exactly that way. The pinned Checkov release is installed into an isolated virtualenv with a simple checkov command on the path, a first boot service self verifies the scanner on your own instance and records the instance details to a root only note, and a daily timer scans a drop in directory and logs the report. Nothing listens on the network, the only remote surface is SSH with your own key, and the image is scanned clean of fixable vulnerabilities before it is sealed. Every deployment comes with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Scan Terraform, CloudFormation and Kubernetes for policy violations before deploy
- Gate infrastructure changes in a CI pipeline on a failing security check
- A self hosted policy as code scanner you own inside your own cloud account
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.