🔬 Scanopy — Container Vulnerability Scanner
Host: Homelab · Compose: Homelab/Docker/scanopy/compose.yaml
Stack name: scanopy
1. Overview
Scanopy is a container image vulnerability scanner. A persistent daemon scans containers on the host (via Docker socket) and reports CVEs. A central server aggregates results, stores them in PostgreSQL, and serves the web UI. The daemon uses host network mode to discover all running containers.
2. Architecture & Services
| Service |
Image |
Port |
Role |
daemon |
scanopy/scanopy/daemon:v0.16.2 |
60073 |
Scans Docker images on the host for vulnerabilities |
server |
scanopy/scanopy/server:v0.16.2 |
60072 |
Web UI and API for viewing scan results |
postgres |
postgres:17-alpine |
— |
Scan result storage |
3. Networking
daemon — Uses network_mode: host so it can reach the Docker socket and all container metadata.scanopy — Bridge network connecting the server and PostgreSQL.- Server reaches the daemon via
http://172.17.0.1:60073 (Docker bridge gateway).
4. Persistent Storage
| Container |
Host Path / Volume |
Description |
daemon |
daemon-config (named vol) |
Daemon registration and config |
server |
./data |
Server-side scan report data |
postgres |
postgres_data (named vol) |
PostgreSQL vulnerability database |
5. Environment Variables
| Variable |
Service |
Description |
SCANOPY_LOG_LEVEL |
Both |
Log verbosity (info) |
SCANOPY_SERVER_PORT |
Both |
Server port (60072) |
SCANOPY_DAEMON_PORT |
Both |
Daemon port (60073) |
SCANOPY_SERVER_URL |
Daemon |
Where to report results |
SCANOPY_DATABASE_URL |
Server |
PostgreSQL connection string |
POSTGRES_PASSWORD |
Postgres |
Set via .env or defaults to password |
SCANOPY_PUBLIC_URL |
Server |
Public-facing URL |
6. Access & Usage
| URL |
Description |
http://localhost:60072 |
Scanopy web UI |
# Start
docker compose -f Homelab/Docker/scanopy/compose.yaml up -d
# Check daemon health
curl -f http://localhost:60073/api/health
7. Maintenance & Backup
# Update
docker compose -f Homelab/Docker/scanopy/compose.yaml pull
docker compose -f Homelab/Docker/scanopy/compose.yaml up -d
No critical persistent data — scan results can be regenerated by re-scanning.