Base
Hardened build
minimal ports, security patches applied at build time
KICS on Ubuntu 24.04
Azure
Security
KICS, the open source scanner that keeps infrastructure as code secure by flagging misconfigurations and compliance issues across Terraform, Kubernetes, CloudFormation, Ansible, Docker and more.
Overview
KICS (Keeping Infrastructure as Code Secure) is a widely used open source static analysis scanner from Checkmarx that inspects your Infrastructure as Code and reports security misconfigurations and compliance issues before they ever reach a cloud account. It parses Terraform, CloudFormation, Kubernetes manifests, Ansible, Dockerfile and Docker Compose, Helm charts, ARM and Bicep, OpenAPI, gRPC, Pulumi and Crossplane, and evaluates each against an embedded library of more than two thousand queries covering the security guidance of the major cloud and platform providers. Every finding names the query, the file, the line, the severity and a description of the risk, and results can be written as JSON or SARIF so they drop straight into a code review, a dashboard or a pipeline gate. Because the query library ships with the scanner and is evaluated locally, scanning needs no outbound internet at all, so it runs the same on a laptop, in a build runner or on a locked down host.
It suits any team that wants to catch insecure infrastructure early: gating merges in continuous integration, auditing an existing estate of templates and manifests, or giving platform and security engineers a fast, repeatable way to check a change before it is applied.
Why the cloudimg image
KICS has no login and no listening service, so what matters is that it is ready to scan the moment the instance boots, and cloudimg ships it exactly that way. The pinned scanner and its pinned query library are installed from the official release and each is verified against its published checksum, and a simple wrapper means a full scan of a directory you choose is a single command with no query paths to remember. A scheduled scan runs daily over a target directory you configure and writes machine readable JSON and SARIF reports for a pipeline to collect. Because the queries are evaluated locally, scanning needs no outbound internet at all, so the instance runs happily in an isolated subnet. Read only self test fixtures are included so you can prove detection works on your own instance, a first boot service self verifies the engine and records a baseline scan, and every deployment comes with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Scan Terraform, Kubernetes and CloudFormation for security misconfigurations
- Gate continuous integration on IaC findings using JSON or SARIF reports
- Audit an existing estate of infrastructure templates fully offline
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.