Base
Hardened build
minimal ports, security patches applied at build time
Gitleaks on Ubuntu 24.04
Azure
Security
Gitleaks, the open source secret scanner that finds hardcoded API keys, tokens and private keys across git history and your project files.
Overview
Gitleaks is the widely used open source secret scanner. It reads your source code, configuration and git commit history and flags hardcoded secrets, API keys, cloud access keys, database passwords, private keys and tokens, using an embedded ruleset of more than one hundred and sixty detection patterns that recognise the credential formats of the major cloud and SaaS providers. It works in two complementary modes: a git mode that walks the entire commit history of a repository so a secret that was committed once and later deleted is still caught, and a directory mode that scans plain files and working trees. Every finding names the rule, the file, the line and the offending value, and results can be written as JSON or SARIF so they drop straight into a code review, a dashboard or a pipeline gate. The scanner is a single self contained binary with no database to maintain and no network access required, so it runs the same on a laptop, in a build runner or on a locked down host with no outbound internet.
It suits any team that wants to keep secrets out of source control: scanning repositories before they are shared, gating merges in continuous integration, or auditing an existing codebase for credentials that were committed by mistake.
Why the cloudimg image
Gitleaks has no login and no listening service, so what matters is that it is ready to scan the moment the instance boots, and cloudimg ships it exactly that way. The pinned scanner is installed from the official release and verified against its published checksum, git is preinstalled so commit history scanning works out of the box, and a scheduled scan of a directory you choose runs daily and writes machine readable JSON and SARIF reports for a pipeline to collect. Because the detection rules are built into the binary, scanning needs no outbound internet at all, so the instance runs happily in an isolated subnet. Read only self test fixtures are included so you can prove detection works on your own instance, a first boot service records a baseline scan, and every deployment comes with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Scan a repository and its full git history for committed secrets
- Gate continuous integration on secret detection using JSON or SARIF reports
- Audit project directories for hardcoded credentials fully offline
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.