TSYSDevStack/ToolboxStack/output/toolbox-qadocker

🔍 Toolbox-QADocker

Docker Image Auditing & Quality Assurance

Toolbox-QADocker is a specialized Docker image designed for auditing and quality assurance of Docker images and related files. It serves as the bootstrap image that audits the toolbox-base and other custom toolboxes in the TSYSDevStack ecosystem.

---

🎯 Purpose

🧰 Feature	📋 Description
🔍 Docker Image Auditing	Equipped with tools like Hadolint, Dive, and Trivy for comprehensive Docker image analysis
📜 Shell Script Validation	Includes ShellCheck for validating shell scripts
🔁 Bootstrap Tool	Used to audit the base and other custom toolboxes during development
⚡ Quick Rebuilds	Designed to be minimal and quick to rebuild when needed

---

🛠️ Tools Included

🛠️ Tool	📝 Description
🐳 Hadolint	Dockerfile linter that checks for best practices
🐚 ShellCheck	Static analysis tool for shell scripts
🛡️ Trivy	Comprehensive vulnerability scanner for containers
🐳 Docker Client	Command-line interface for Docker
🔍 Dive	Tool to explore layers in Docker images
🏗️ Buildctl	BuildKit client for advanced builds
🐳 Dockerlint	Additional Dockerfile linter
🟨 Node.js	JavaScript runtime for additional tooling

---

📊 Image Details

🧩 Aspect	📌 Value
🏗️ Base Image	Ubuntu 24.04
🔐 Foundation	Does NOT use the toolbox-base as foundation (unlike other toolboxes)
👤 Non-Root User	Contains a non-root user qadocker for security
⚡ Optimization	Optimized for fast rebuilds and audits

---

🚀 Usage

🏗️ Build the Image

./build.sh

🖥️ Run the Container Interactively

./run.sh

🐳 Run Directly with Docker

docker run -it --rm \
  -v "$(pwd)":/workspace \
  -w /workspace \
  tsysdevstack-toolboxstack-toolbox-qadocker:dev \
  bash

🔍 Run QA on a Dockerfile

docker run --rm -v /path/to/project:/workspace -w /workspace tsysdevstack-toolboxstack-toolbox-qadocker:dev hadolint --config .hadolint.yaml Dockerfile

🐚 Run QA on Shell Scripts

docker run --rm -v /path/to/project:/workspace -w /workspace tsysdevstack-toolboxstack-toolbox-qadocker:dev shellcheck script.sh

📊 Run Comprehensive Audit

# Using the custom audit script
docker run --rm -v /path/to/project:/workspace -w /workspace tsysdevstack-toolboxstack-toolbox-qadocker:dev bash -c "./audit-dockerfile.sh Dockerfile"

---

👤 Non-Root User

• 🏃‍♂️ The container runs as the qadocker user by default
• 🛡️ For security purposes, this reduces attack surface
• 🧑‍💻 If you need root access, run the container with --user root

---

🔒 Security

🔒 Security Aspect	📋 Details
🛡️ Best Practices	Built with security best practices in mind
🔓 Attack Surface	Minimal attack surface
👤 User Privileges	Non-root user for running tools
🛡️ Scanning	Regular security scanning with Trivy

---

🛠️ Development

• 🧩 This image is designed to be simple to modify and rebuild
• 🧱 The Dockerfile contains all necessary tool installations
• 🚀 Optimized for caching and build speed
• 🧪 Includes custom audit scripts for Dockerfile best practices

---

🔍 QA Process

✅ QA Step	📝 Description
🐳 Hadolint Validation	Validating the Dockerfile with Hadolint
🐚 ShellCheck	Checking shell scripts with ShellCheck
🛡️ Trivy Scan	Running filesystem scans with Trivy
🧪 Tool Verification	Verifying all tools are properly installed
📊 Custom Audit	Using custom scripts to check for best practices

---

📈 Audit Capabilities

Toolbox-QADocker excels at identifying:

• ❌ Security Issues: Common vulnerabilities and misconfigurations
• ⚙️ Best Practices: Adherence to Dockerfile best practices
• 🔒 Root Usage: Minimizing root operations in Docker builds
• 🚀 Optimization: Layer efficiency and image size optimization
• 🛡️ Configuration Issues: Potential security misconfigurations

---

📄 License

See LICENSE for full terms.