Scanning Container Images via Checkmarx One CLI - Flag Validation and Best Practices

# Create structured directory
mkdir -p docker.io/library

# Copy image with tag annotation - IMPORTANT: include :tag in destination
skopeo copy --override-os linux --override-arch amd64 \
  docker://alpine:latest oci:docker.io/library/alpine:3.19

Critical: Always include the tag (:latest, :3.19) in the Skopeo destination path to ensure proper annotation in index.json. Without it, the CLI won't be able to determine the image tag.

cat docker.io/library/alpine/index.json | python3 -m json.tool

Expected output should include:

"annotations": {
  "org.opencontainers.image.ref.name": "3.19"
}

If this annotation is missing, the image will be skipped during scanning.

cx scan create \
  --project-name my-project \
  -s ./source \
  --branch main \
  --scan-types container-security \
  --container-images "oci-dir:docker.io/library/alpine" \
  --containers-local-resolution

Note: Do NOT add the tag :3.19 to the --container-images value. The tag is automatically read from index.json.

# Save image with authentication
skopeo copy --src-creds username:password \
  --override-os linux --override-arch amd64 \
  docker://private-registry.com/myapp:v1.0 \
  oci:private-registry.com/myapp:v1.0

# Scan (no tag needed in CLI command)
cx scan create --project-name myapp \
  -s . --scan-types container-security \
  --container-images "oci-dir:private-registry.com/myapp" \
  --containers-local-resolution

# Save multiple images with tags
skopeo copy docker://nginx:1.21 oci:docker.io/library/nginx:1.21
skopeo copy docker://postgres:14 oci:docker.io/library/postgres:14

# Scan all (no tags in CLI command)
cx scan create --project-name my-app \
  -s ./source --scan-types container-security \
  --container-images "oci-dir:docker.io/library/nginx,oci-dir:docker.io/library/postgres" \
  --containers-local-resolution

# Save different architectures with tags
skopeo copy --override-arch amd64 \
  docker://alpine:latest oci:images/alpine-amd64:latest

skopeo copy --override-arch arm64 \
  docker://alpine:latest oci:images/alpine-arm64:latest

# Scan both architectures (no tags in CLI command)
cx scan create --project-name multi-arch \
  -s . --scan-types container-security \
  --container-images "oci-dir:images/alpine-amd64,oci-dir:images/alpine-arm64" \
  --containers-local-resolution

Cause: OCI directory created without tag annotation in the destination path.

Solution:

#  Wrong - no tag in destination
skopeo copy docker://alpine:latest oci:my-alpine-image

#  Correct - tag included in destination
skopeo copy docker://alpine:latest oci:my-alpine-image:latest

The tag must be specified in the Skopeo copy command's destination (after oci:), not in the CLI scan command.

Cause: Image contains no analyzable packages or is corrupted/empty.

Solution: 1. Verify image integrity: skopeo inspect oci:path/to/image 2. Re-pull and save the image 3. Check if base image actually contains packages (e.g., scratch images have none)

Cause: OCI directory path is incorrect or not accessible.

Solution: - Use absolute paths: oci-dir:/absolute/path/to/image - Or ensure relative paths are correct from the CLI execution directory

# Option 1: Build from Dockerfile
buildah bud -t myapp:v1.0 .

# Option 2: Build from scratch (no Dockerfile)
buildah from scratch
buildah copy working-container /etc/os-release /
buildah commit working-container myapp:v1.0

# Option 3: Build from an existing image
# Create a working container from a specific, full image name - in this case, traefik:v2
new_container=$(buildah from docker.io/library/traefik:v2)

# You can now run commands, add files, or set config
buildah run $new_container -- touch /newfile.txt
buildah config --author "Your Name" $new_container

# Commit your changes to a new image
buildah commit $new_container myapp:v1.0

# Option A: Push to OCI directory
# IMPORTANT: include :tag in destination
buildah push localhost/myapp:v1.0 oci:/output/docker.io/library/myapp:v1.0

# Option B: Save to docker-archive tar (includes tag in tar metadata)
# IMPORTANT: include both imagename and tag in destination
# in this case: myapp.tar:testapp:v1.0 -> file-name=myapp.tar, image-name=testapp, image-tag=v1.0)
buildah push localhost/myapp:v1.0 docker-archive:/output/myapp.tar:testapp:v1.0

# Option C: Save to oci-archive tar
# IMPORTANT: include :tag in destination
# in this case: myapp.tar:v1.0 -> image-name=myapp, image-tag=v1.0 
buildah push localhost/myapp:v1.0 oci-archive:/output/myapp.tar:v1.0

Critical: Always include the tag (:v1.0, :latest) in the Buildah destination path to ensure proper annotation in index.json (for OCI formats) or tar metadata (for docker-archive). This is identical to Skopeo's requirement.

# Check that tag annotation exists
cat /output/docker.io/library/myapp/index.json | grep -A2 "annotations"

# Or use jq for formatted output
cat /output/docker.io/library/myapp/index.json | jq '.manifests[].annotations'

Expected output:

{
  "org.opencontainers.image.ref.name": "v1.0"
}

# For OCI directory (Step 2 -> Option A)
cx scan create \
  --project-name myapp \
  -s ./source \
  --branch main \
  --scan-types container-security \
  --container-images "oci-dir:/output/docker.io/library/myapp" \
  --containers-local-resolution

# For docker-archive (Step 2 -> Option B)
cx scan create \
  --project-name myapp \
  -s ./source \
  --branch main \
  --scan-types container-security \
  --container-images "docker-archive:/output/myapp.tar"

# For oci-archive (Step 2 -> Option C)
cx scan create \
  --project-name myapp \
  -s ./source \
  --branch main \
  --scan-types container-security \
  --container-images "oci-archive:/output/myapp.tar"

Note: For OCI directory, the tag is NOT specified in the CLI command - it's automatically read from index.json.

# Build multi-stage Dockerfile
buildah bud -t frontend:v2.0 -f Dockerfile.frontend .

# Save to OCI directory with tag
buildah push frontend:v2.0 oci:builds/frontend:v2.0

# Scan
cx scan create --project-name frontend \
  -s . --scan-types container-security \
  --container-images "oci-dir:builds/frontend" \
  --containers-local-resolution

# Build multiple images with different tags
buildah bud -t myapp:latest .
buildah bud -t myapp:v1.0 .
buildah bud -t myapp:stable .

# Save all with tags
buildah push myapp:latest oci:images/myapp:latest
buildah push myapp:v1.0 oci:images/myapp-v1:v1.0
buildah push myapp:stable oci:images/myapp-stable:stable

# Scan all versions
cx scan create --project-name myapp \
  -s . --scan-types container-security \
  --container-images "oci-dir:images/myapp,oci-dir:images/myapp-v1,oci-dir:images/myapp-stable" \
  --containers-local-resolution

# Pull from private registry, modify, and save for scanning
buildah pull --creds username:password private-registry.com/baseimage:v1.0
buildah bud -t myapp:v2.0 --from private-registry.com/baseimage:v1.0 .

# Save to OCI directory
buildah push myapp:v2.0 oci:registry-mirror/myapp:v2.0

# Scan
cx scan create --project-name myapp \
  -s . --scan-types container-security \
  --container-images "oci-dir:registry-mirror/myapp" \
  --containers-local-resolution

# Build for different architectures
buildah bud --arch amd64 -t myapp:v1.0-amd64 .
buildah bud --arch arm64 -t myapp:v1.0-arm64 .

# Save each architecture
buildah push myapp:v1.0-amd64 oci:images/myapp-amd64:v1.0
buildah push myapp:v1.0-arm64 oci:images/myapp-arm64:v1.0

# Scan both architectures
cx scan create --project-name myapp \
  -s . --scan-types container-security \
  --container-images "oci-dir:images/myapp-amd64,oci-dir:images/myapp-arm64" \
  --containers-local-resolution

Cause: OCI directory created without tag annotation in the destination path.

Solution:

#  Wrong - no tag in destination
buildah push myapp:v1.0 oci:myapp-dir

#  Correct - tag included in destination
buildah push myapp:v1.0 oci:myapp-dir:v1.0

The tag must be specified in the Buildah push command's destination (after oci:), matching the Skopeo requirement.

Cause: Built image contains no analyzable packages (e.g., scratch-based images with only binaries).

Solution: 1. Verify image was built correctly: buildah images 2. Inspect image contents: buildah inspect myapp:v1.0 3. If using FROM scratch, ensure you're installing packages or using a base image with an OS 4. For minimal images, this is expected behavior - Checkmarx skips images with no packages

Cause: Image exists in Buildah's local storage but not properly tagged.

Solution:

# List all Buildah images
buildah images

# If image is missing tag, re-tag it
buildah tag <image-id> myapp:v1.0

# Then push with proper tag
buildah push myapp:v1.0 oci:path/to/dir:v1.0

Cause: Buildah requires proper permissions for rootless operation.

Solution:

# Ensure subuid/subgid are configured
cat /etc/subuid
cat /etc/subgid

# Run buildah in rootless mode
buildah unshare buildah bud -t myapp:v1.0 .