Note: There is no official Docker image for OpenSCAP from the OpenSCAP project. However, community and distribution-specific images are available.
Several community-maintained OpenSCAP images exist:
# Example: Red Hat-based OpenSCAP image
docker pull quay.io/centos/centos:stream9
docker run --rm -it quay.io/centos/centos:stream9 bash
# Then install: dnf install openscap openscap-scanner
Create a Dockerfile for Debian/Ubuntu-based systems:
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y \
openscap-scanner \
libopenscap8 \
&& rm -rf /var/lib/apt/lists/*
ENTRYPOINT ["oscap"]
Build and run:
docker build -t openscap .
docker run --rm -v /path/to/content:/content openscap xccdf eval /content/scap-content.xml
For system scanning, installing directly on the host is recommended:
# Debian/Ubuntu
sudo apt install openscap-scanner
# RHEL/CentOS/Fedora
sudo dnf install openscap-scanner
See OpenSCAP Setup for installation instructions.