Base
Hardened build
minimal ports, security patches applied at build time
ScanCode.io on Ubuntu 24.04 LTS
Azure
Developer Tools
ScanCode.io, automated software composition analysis, running scan pipelines over your codebases and containers to report the licences, copyrights and package dependencies they actually contain.
Overview
ScanCode.io is a server for automated software composition analysis. You give it a codebase, an archive or a container image, choose a pipeline, and it scans every file and reports what is really in there: the detected licences and copyright notices, the packages and their declared dependencies, and how those findings map back to the exact files they came from. Results are browsable in a web interface, queryable through a REST API, and exportable as SPDX or CycloneDX so they can feed a software bill of materials.
It suits engineering and open source programme teams who need evidence rather than assumption about what their software contains: proving the licence position of a release before it ships, producing an SBOM for a customer or a regulator, auditing an inherited or acquired codebase, and inspecting what a container image actually bundles. Pipelines run asynchronously on a worker queue, so a large scan runs in the background while the interface stays responsive.
Why the cloudimg image
ScanCode.io ships upstream with authentication switched off, which on a public cloud instance would let anyone submit scan pipelines and run arbitrary workloads on your machine, so cloudimg turns authentication on before the application is ever reachable and refuses to build an instance without it. Every shared secret is unique per instance: the session signing key, the database password and the administrator account with its REST API key are all generated on first boot and written to a root only file, so no two instances share a credential and nothing is baked into the image. The database and the scan workspace, which is the part that actually grows, live on a dedicated data volume that is captured into the image and re provisioned on every instance. Every component is pinned by digest so the instance is reproducible and scannable, a self test command proves a complete scan round trip on your own instance whenever you want it, and every deployment comes with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Prove the licence position of a release before it ships
- Generate an SBOM in SPDX or CycloneDX for customers or regulators
- Audit an inherited codebase or inspect what a container image bundles
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Developer Tools
Aa
Apache Archiva Repository Manager
Developer Tools
This image runs Apache Archiva, the open source build-artifact repository manager - a central, governed store for the bi...
Appsmith Open-Source Low-Code Platform
Developer Tools
This image runs Appsmith Community Edition, the open source low-code platform for building internal tools, admin panels,...
Beszel Server and Container Monitoring Hub
Developer Tools
This image runs Beszel, the open source, lightweight server and container monitoring hub - a clean web dashboard with hi...
changedetection.io - Website Change Monitor
Developer Tools
This image runs changedetection.io, the self-hosted service that monitors web pages for changes and notifies you when so...
Docker CE on Windows - Containerization Platform
Developer Tools
Docker Community Edition is the free, open source container runtime that allows you to package applications and their de...
Grafana OSS - Observability and Dashboarding
Developer Tools
This image runs Grafana OSS, the leading open source observability and dashboarding platform.