{"id":13587982,"url":"https://github.com/jumanjihouse/docker-ssllabs-scan","last_synced_at":"2026-01-04T00:48:57.636Z","repository":{"id":32161996,"uuid":"35735178","full_name":"jumanjihouse/docker-ssllabs-scan","owner":"jumanjihouse","description":"Qualys sslabs-scan utility in a tiny docker image","archived":false,"fork":false,"pushed_at":"2024-07-22T23:00:43.000Z","size":222,"stargazers_count":115,"open_issues_count":3,"forks_count":24,"subscribers_count":7,"default_branch":"master","last_synced_at":"2024-08-02T16:08:35.408Z","etag":null,"topics":["docker","scanner","security-tools","tls"],"latest_commit_sha":null,"homepage":"https://registry.hub.docker.com/u/jumanjiman/ssllabs-scan/","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":"AUCyberClub/axion","license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jumanjihouse.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-05-16T18:27:23.000Z","updated_at":"2024-07-19T16:29:14.000Z","dependencies_parsed_at":"2023-01-14T20:39:29.887Z","dependency_job_id":null,"html_url":"https://github.com/jumanjihouse/docker-ssllabs-scan","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jumanjihouse%2Fdocker-ssllabs-scan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jumanjihouse%2Fdocker-ssllabs-scan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jumanjihouse%2Fdocker-ssllabs-scan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jumanjihouse%2Fdocker-ssllabs-scan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jumanjihouse","download_url":"https://codeload.github.com/jumanjihouse/docker-ssllabs-scan/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":223300641,"owners_count":17122657,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["docker","scanner","security-tools","tls"],"created_at":"2024-08-01T15:06:27.196Z","updated_at":"2026-01-04T00:48:57.576Z","avatar_url":"https://github.com/jumanjihouse.png","language":"Shell","funding_links":[],"categories":["Shell"],"sub_categories":[],"readme":"SSL site scanner\n================\n\n[![Docker Registry](https://img.shields.io/docker/pulls/jumanjiman/ssllabs-scan.svg)](https://registry.hub.docker.com/u/jumanjiman/ssllabs-scan \"Go to Docker hub\")\u0026nbsp;\n[![Circle CI](https://circleci.com/gh/jumanjihouse/docker-ssllabs-scan.png?style=svg\u0026circle-token=b75db48608f115c0cb9760708be3839b48d41f8e)](https://circleci.com/gh/jumanjihouse/docker-ssllabs-scan/tree/master 'View CI builds')\n\nSource code:    https://github.com/jumanjihouse/docker-ssllabs-scan/\u003cbr/\u003e\nDocker image:   https://registry.hub.docker.com/u/jumanjiman/ssllabs-scan/\u003cbr/\u003e\n\n:warning: You must use version 1.4.0 or later of this image\nfor compatibility with the Qualys SSL Labs Service API.\n\n- [About](#about)\n  - [Overview](#overview)\n  - [Build integrity](#build-integrity)\n  - [License](#license)\n- [How-to](#how-to)\n  - [Build and test](#build-and-test)\n  - [Pull an already-built image](#pull-an-already-built-image)\n  - [View image labels](#view-image-labels)\n  - [Scan public sites](#scan-public-sites)\n  - [Scan private sites](#scan-private-sites)\n\n\nAbout\n-----\n\n### Overview\n\nThis git repo downloads golang source code from\nhttps://github.com/ssllabs/ssllabs-scan\nand builds a tiny docker image that scans secure websites\nwith the Qualys SSL Labs service.\n\nThe build takes about 30 seconds and results in a 5 MiB Docker image.\n\u003cbr/\u003eThe runtime image contains **only**:\n\n* a static binary,\n* CA certificates,\n* `/etc/nsswitch.conf` so golang net resolver uses `/etc/hosts`, and\n* `/etc/passwd` to provide an unprivileged user.\n\nThe container runs as an unprivileged user via the technique described in\n[this Medium post](https://medium.com/@lizrice/non-privileged-containers-based-on-the-scratch-image-a80105d6d341).\n\nBefore you use this tool please review the terms and conditions,\nwhich can be found here:\nhttps://www.ssllabs.com/about/terms.html\n\n\n### Build integrity\n\nThe repo is set up to compile the software in a \"builder\" container, then\ncopy the statically-compiled binary into a \"runtime\" container\nfree of development tools or other binaries that could be abused.\nAn unattended test harness runs the build script and runs acceptance tests.\nIf all tests pass on master branch in the unattended test harness,\nit pushes the built images to the Docker hub.\n\n![workflow](assets/docker_hub_workflow.png)\n\n\n### License\n\nSee [LICENSE.md](https://github.com/jumanjiman/docker-ssllabs-scan/blob/master/LICENSE.md)\nin this git repo.\n\n\nHow-to\n------\n\n### Build and test\n\n:warning: Build requires Docker CE 17.06.1 (for multi-stage builds) or later\nas well as docker-compose.\n\n    ci/build\n    ci/test\n\n\n### Pull an already-built image\n\nFor user convenience, each published image is tagged with\n`\u003cupstream-version-number\u003e-\u003cdate\u003eT\u003ctime\u003e-git-\u003cgit-short-hash\u003e` to correlate\nwith both the upstream software release and the git commit\nof this repo. The \"latest\" tag always points to the most\nrecent build.\n\n    docker pull jumanjiman/ssllabs-scan:latest\n\n\n### View image labels\n\nEach built image has labels that generally follow http://label-schema.org/\n\nWe add a label, `ci-build-url`, that is not currently part of the schema.\nThis extra label provides a permanent link to the CI build for the image.\n\nView the ci-build-url label on a built image:\n\n    docker inspect \\\n      -f '{{ index .Config.Labels \"io.github.jumanjiman.ci-build-url\" }}' \\\n      jumanjiman/ssllabs-scan\n\nQuery all the labels inside a built image:\n\n    docker inspect jumanjiman/ssllabs-scan | jq -M '.[].Config.Labels'\n\n\n### Scan public sites\n\nThe following example uses `--read-only` and `--cap-drop all` as recommended by the\nCIS Docker Security Benchmarks:\n\n* [Docker 1.6](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.6_Benchmark_v1.0.0.pdf)\n* [Docker 1.11](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.11.0_Benchmark_v1.0.0.pdf)\n* [Docker 1.12](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.12.0_Benchmark_v1.0.0.pdf)\n* [Docker 1.13](https://benchmarks.cisecurity.org/tools2/docker/CIS_Docker_1.13.0_Benchmark_v1.0.0.pdf)\n\nExample:\n\n    $ docker_opts=\"--read-only --cap-drop all --rm -it\"\n    $ image=\"jumanjiman/ssllabs-scan:latest\"\n    $ scan_opts=\"-grade -usecache\"\n    $ url_to_scan=\"https://github.com/\"\n    $ docker run ${docker_opts} ${image} ${scan_opts} ${url_to_scan}\n    2015/06/14 23:01:01 [INFO] SSL Labs v1.18.1 (criteria version 2009j)\n    2015/06/14 23:01:01 [NOTICE] Server message: This assessment service is provided free of charge by Qualys SSL Labs, subject to our terms and conditions: https://www.ssllabs.com/about/terms.html\n    2015/06/14 23:01:03 [INFO] Assessment starting: https://github.com\n    2015/06/14 23:01:04 [INFO] Assessment complete: https://github.com (1 host in 96 seconds)\n        192.30.252.129: A+\n    \"https://github.com\": \"A+\"\n\n    2015/06/14 23:01:04 [INFO] All assessments complete; shutting down\n\n\nYou can also use the `-hostfile` option if you inject a local\nfile into the container:\n\n    # Create a hostfile in local filesystem.\n    $ ls -la /tmp/sites.txt\n    -rw-r--r--    1 user     user            48 Mar 12 15:39 /tmp/sites.txt\n\n    # Use docker `-v` option to inject a file into the container to use -hostfile option.\n    $ docker run -v /tmp:/tmp:ro ${docker_opts} ${image} -hostfile /tmp/sites.txt ${scan_opts}\n    2016/03/12 15:45:01 [INFO] SSL Labs v1.22.37 (criteria version 2009l)\n    2016/03/12 15:45:01 [NOTICE] Server message: This assessment service is provided free of charge by Qualys SSL Labs, subject to our terms and conditions: https://www.ssllabs.com/about/terms.html\n    2016/03/12 15:45:03 [INFO] Assessment starting: https://www.github.com/\n    2016/03/12 15:45:04 [INFO] Assessment starting: https://www.google.com/\n    2016/03/12 15:45:04 [INFO] Assessment complete: https://www.github.com/ (1 host in 83 seconds)\n        192.30.252.129: A\n    2016/03/12 15:45:05 [INFO] Assessment complete: https://www.google.com/ (2 hosts in 109 seconds)\n        2607:f8b0:4005:802:0:0:0:2004: B\n        172.217.2.36: B\n    \"https://www.github.com/\": \"A\"\n    \"https://www.google.com/\": \"B\"\n\n    2016/03/12 15:45:05 [INFO] All assessments complete; shutting down\n\n\nYou can use `docker-compose` with the `docker-compose.yaml` file in this git repo:\n\n    $ docker-compose run --rm scanner -grade -usecache https://github.com\n    2017/05/13 15:35:37 [INFO] SSL Labs v1.28.5 (criteria version 2009o)\n    2017/05/13 15:35:37 [NOTICE] Server message: This assessment service is provided free of charge by Qualys SSL Labs, subject to our terms and conditions: https://www.ssllabs.com/about/terms.html\n    2017/05/13 15:35:39 [INFO] Assessment starting: https://github.com\n    2017/05/13 15:35:40 [INFO] Assessment complete: https://github.com (2 hosts in 108 seconds)\n        192.30.255.112: A+\n        192.30.255.113: A+\n    \"https://github.com\": \"A+\"\n\n    2017/05/13 15:35:40 [INFO] All assessments complete; shutting down\n\n\n### Scan private sites\n\nYou can add entries to `/etc/hosts` via `docker run --add-host`\nor via the docker-compose `extra_hosts` option.\nHowever, this scanner is only a client to the\n[Qualys SSL Labs service](https://www.ssllabs.com/ssltest/).\nIf the hosted service cannot resolve your hostname,\nit cannot scan your server.\nIf the hosted service cannot reach your server,\nit cannot perform the scan.\n\nConsider to use https://github.com/jumanjihouse/docker-testssl\nif you need to scan internal sites that are not reachable from\nthe public Internet.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjumanjihouse%2Fdocker-ssllabs-scan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjumanjihouse%2Fdocker-ssllabs-scan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjumanjihouse%2Fdocker-ssllabs-scan/lists"}