Skip to main content

Dynamic Engines - Using Docker

You can create and destroy dynamic engines using Docker containers or VMs in all cloud networks.

Engines can be created to be dedicated for each single scan, for some of the scans (for example, only for specific LOC ranges), or depending on the system status.

The following example shows how to create a Docker container engine for each scan and destroy it after it is finished, canceled, or failed.

It illustrates using Docker in SAST scans and includes three recently developed features you can find more information about here:


The following prerequisites are required for running this example on Windows:

  1. WSL must be configured on Windows

  2. Docker Desktop for Windows is installed

  3. Docker Engine is configured for your DNS server to be able to resolve hostnames in your network

    • 1.png
  4. WSL is enabled in Docker Settings

    • 2.png
  5. SAST AIO is installed locally (HA and other modes should be possible with minor changes)

Setting up the Environment

  1. Download cxsast-engine-server-docker-image (cx-engine-server.tar)

  2. Copy the engine image to WSL (e.g. \wsl.localhost\Ubuntu\home\<userName>\checkmarx\cx-sast-linux-server)

  3. Make sure Docker Desktop is running

  4. Open WSL (Ubuntu console) and run the docker load command

    • docker load < ./checkmarx/cx-sast-linux-server/cx-engine-server.tar

  5. Make sure the image has been loaded in Docker Desktop

    • 3.png

Configuring SAST

In the General Settings page, set the engineStart.bat to Scan Enqueued Script’ and engineCleanup.bat to Scan Dequeued Script.

Configuring these scripts will instruct SAST to run them for every scan created or completed. You have control over whether the scan will be run on a dedicated engine or not via the script return codes (see Scan Enqueued and Dequeued Custom Scripts for Dynamic Engines).


Below you can find the script files used in this example.

Checking Docker Instance and Cleanup

Once everything is configured, ensure the Docker instance is running, and then start a scan.

In this example, only scans with LOC below 1001 would spawn a dedicated engine.

SAST creates an engine instance in Docker where the engine scans and auto-registers the project. After the scan finishes, the spawned engine instance is cleaned up, and the engine is unregistered. The engine scan logs are also available to download.