🔬 Scanopy — Container Vulnerability Scanner
Host: Homelab · Compose:
Homelab/Docker/scanopy/compose.yaml
Stack name:scanopy
1. Overview
Scanopy is a container image vulnerability scanner. A persistent daemon scans containers on the host (via Docker socket) and reports CVEs. A central server aggregates results, stores them in PostgreSQL, and serves the web UI. The daemon uses host network mode to discover all running containers.
2. Architecture & Services
| Service | Image | Port | Role |
|---|---|---|---|
daemon |
ghcr.io/scanopy/scanopy/daemon:v0.17.16 |
${SCANOPY_DAEMON_PORT |
Scans Docker images on the host for vulnerabilities |
postgres |
postgres:17-alpine@sha256:6f30057d31f5861b66f3545d4821f987aacf1dd920765f0acadea0c58ff975b1 |
— | Scan result storage |
server |
ghcr.io/scanopy/scanopy/server:v0.17.16 |
${SCANOPY_SERVER_PORT |
Web UI and API for viewing scan results |
3. Networking
host— —scanopy— Bridge network connecting the server and PostgreSQL.
4. Persistent Storage
| Container | Host Path / Volume | Description |
|---|---|---||
| daemon | /var/run/docker.sock | — |
| daemon | daemon-config | — |
| postgres | postgres_data | — |
| server | ./data | Server-side scan report data |
5. Environment Variables
| Variable | Service | Description |
|---|---|---|
SCANOPY_BIND_ADDRESS |
daemon |
— |
SCANOPY_DAEMON_PORT |
daemon |
Daemon port (60073) |
SCANOPY_HEARTBEAT_INTERVAL |
daemon |
— |
SCANOPY_LOG_LEVEL |
daemon |
Log verbosity (info) |
SCANOPY_MODE |
daemon |
— |
SCANOPY_NAME |
daemon |
— |
SCANOPY_PORT |
daemon |
— |
SCANOPY_SERVER_PORT |
daemon |
Server port (60072) |
SCANOPY_SERVER_URL |
daemon |
Where to report results |
POSTGRES_DB |
postgres |
— |
POSTGRES_PASSWORD |
postgres |
Set via .env or defaults to password |
POSTGRES_USER |
postgres |
— |
SCANOPY_DAEMON_PORT |
server |
Daemon port (60073) |
SCANOPY_DATABASE_URL |
server |
PostgreSQL connection string |
SCANOPY_INTEGRATED_DAEMON_URL |
server |
— |
SCANOPY_LOG_LEVEL |
server |
Log verbosity (info) |
SCANOPY_PUBLIC_URL |
server |
Public-facing URL |
SCANOPY_SERVER_PORT |
server |
Server port (60072) |
SCANOPY_WEB_EXTERNAL_PATH |
server |
— |
6. Access & Usage
| URL | Description |
|---|---|
http://localhost:60072 |
Scanopy web UI |
# Start
docker compose -f Homelab/Docker/scanopy/compose.yaml up -d
# Check daemon health
curl -f http://localhost:60073/api/health
7. Maintenance & Backup
# Update
docker compose -f Homelab/Docker/scanopy/compose.yaml pull
docker compose -f Homelab/Docker/scanopy/compose.yaml up -d
No critical persistent data — scan results can be regenerated by re-scanning.