scan

kx scan

Resolves the unique container images of a workload and scans each for vulnerabilities, printing a severity summary table.

Requires the CLI for the selected engine. Docker Scout is the default: https://docs.docker.com/scout/ Trivy is available via --engine trivy: https://trivy.dev/ Grype is available via --engine grype: https://github.com/anchore/grype Run ‘kx engine’ to see or change the default.

Unrecognized flags are passed through to kubectl.

Usage

kx scan [OPTIONS] [index] [scanner flags]

Argument	Description
`[index]`	Row number from the current listing; run kx state to see it

Option	Description
`-A, --all-namespaces`	Sweep every namespace
`--engine string`	Vulnerability scanner to use; run ‘kx engine’ to see available engines and the configured default
`--fail-on string`	Exit 2 when any image carries a vulnerability at this severity or worse (critical, high, medium, low)
`--full`	Stream the scanner’s full output instead of the summary table
`--html`	Render the report as HTML and serve it in a browser
`--json`	Print the severity counts and every finding as JSON instead of a table
`-n, --namespace string`	Namespace to sweep; defaults to the current namespace
`--no-open`	Serve the HTML report without opening a browser
`--out string`	Write the HTML report to this file instead of serving it in a browser
`--port int`	Port to serve the HTML report on; 0 picks a free one

Option	Description
`--no-color`	Disable styled output
`-h, --help`	Show this message and exit

kx scan
kx scan 1
kx scan -n prod
kx scan 1 --full
kx scan --html
kx scan -A --json
kx scan -A --fail-on high --out report.html