ScanCode.io Software Composition Analysis

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Automated Software Composition Analysis, Ready in Minutes

ScanCode.io is an open source server for automated software composition analysis from the AboutCode project. It runs configurable scan pipelines over any codebase - source trees, package archives, Docker images, root filesystems - and reports the licences, copyrights, packages and dependencies it finds, so you can produce accurate SBOMs and answer open source compliance questions with evidence. This image from cloudimg delivers ScanCode.io fully installed and configured as a production appliance on AWS, so your team has a complete, self-hosted scanning platform running without manual setup.

## Why This Image Instead of Alternatives

Unlike a hosted scanning SaaS, this image keeps every codebase you scan and every scan result on your own AWS infrastructure - ideal for teams whose code cannot leave their environment. Unlike a manual Docker Compose or source install, the appliance is pre-configured, digest-pinned and supervised by systemd, eliminating hours of setup and the native-dependency fragility of a source build. And unlike stitching together separate licence and dependency scanners, ScanCode.io consolidates codebase scanning, package and dependency detection, and SBOM output in one pipeline-driven application.

## Application Stack

• ScanCode.io deployed from the official upstream container image, pinned by digest, run as a managed appliance
• PostgreSQL database, Redis queue, a gunicorn web tier, an RQ scan worker and an nginx reverse proxy, reproducing upstream's supported production topology
• All stateful data - the database, the Redis append-only file and the scan workspace - on a dedicated, independently resizable data disk that survives instance replacement
• A single systemd service supervises the whole Compose stack, starting on boot and restarting on failure

## Scanning and Compliance

Create a project, upload or point at a codebase, and run a pipeline: scan_codebase for full licence and copyright detection, analyze_docker_image for container image analysis, inspect_packages and resolve_dependencies for package and dependency discovery, and more. Results are browsable in the Web UI and available over a REST API for automation - wire scans into CI/CD, gate releases on licence policy, and export CycloneDX or SPDX SBOMs. Every scan is evidence-backed down to the individual file and detected licence expression.

## Security Baseline

Authentication is REQUIRED. ScanCode.io ships with authentication disabled by default; this appliance sets SCANCODEIO_REQUIRE_AUTHENTICATION so every Web UI view and REST API endpoint demands a login - an open scanner would let anyone submit pipelines, which is arbitrary workload execution on your instance.

Secure First Boot: On first launch, a one-shot service rotates every shared secret - a fresh Django secret key, a fresh database password, and a fresh administrator account with a unique password and REST API key - before the stack serves a single request, and writes them to a file only the root user can read. No shared or default credential ships in the image.

Network and Encryption: The application is served on port 80 by default. TLS termination and custom domain configuration are supported as post-launch steps - cloudimg support can assist. AWS EBS encryption can be enabled on the data disk to encrypt scanned code and results at rest.

## Use Cases

• Self-hosted open source licence and copyright compliance scanning
• SBOM generation (CycloneDX, SPDX) for products and releases
• Package and dependency discovery across source trees and archives
• Docker container image composition and licence analysis
• Compliance gating wired into CI/CD via the REST API

## Getting Started

The ScanCode.io web interface is served on port 80. Sign in with the generated administrator credentials (found in the root-only file on the instance) to create a project and run your first scan pipeline. The REST API is available on the same port for programmatic scanning and SBOM export.

## cloudimg Support

24/7 technical support by email and chat. Our engineers help with deployment, pipeline configuration, REST API integration, SBOM export, custom domains, TLS certificate setup, data disk resizing and scaling guidance.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.