Base
Hardened build
minimal ports, security patches applied at build time
OSV-Scanner on Ubuntu 24.04
Azure
Security
OSV-Scanner, Google's frontend to the OSV.dev vulnerability database: it reads your projects' lockfiles and reports the known vulnerabilities affecting the exact dependency versions you ship.
Overview
OSV-Scanner is Google's official scanner for the OSV.dev distributed vulnerability database. Point it at a project and it reads the dependency manifests and lockfiles it finds, package locks for npm, PyPI, Go, Maven, crates.io, RubyGems, NuGet, Packagist and more, resolves the exact package versions you depend on, and reports every known vulnerability affecting them with fix guidance where upstream publishes it. Output is human readable in the terminal and machine readable as JSON and SARIF, so the same scan serves an engineer at a shell and a CI pipeline gating a release.
It suits teams who want dependency scanning they run themselves on infrastructure they own: audit a checkout before a release, scan every project in a tree on a schedule, or feed SARIF results into code scanning dashboards.
Why the cloudimg image
cloudimg ships OSV-Scanner as a working scanning host rather than a bare binary. The pinned upstream release binary is verified against the published checksums, and an offline copy of the OSV database covering the major language ecosystems plus Alpine and Debian is baked into the image, so the first scan works instantly with no egress required. A first boot refresh and a daily timer keep that database current for the life of the instance, a second timer scans your configured project tree daily and writes JSON and SARIF reports with stable latest symlinks for CI pickup, and read only known vulnerable and known clean fixtures ship on the image so you can prove the scanner and its documented exit code contract on your own VM in seconds. Nothing listens on the network, SSH with your launch key is the only open port and no credential is baked in. Every deployment comes with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Audit a project's dependencies for known vulnerabilities before a release
- Scheduled offline scans of every project in a tree with SARIF reports for CI
- Air gapped dependency scanning against a locally cached vulnerability database
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.