Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Snyk CLI usage
✓ snyk container test <IMAGE_NAME>:<TAG>
✗ import { DockerPlugin } from 'snyk-docker-plugin'
This package is a plugin for the Snyk CLI and is not designed for direct programmatic import into user applications. Its functionality is exposed via the Snyk CLI commands, specifically `snyk container test`.
Snyk CLI type definitions
✓ import type { SnykTestOptions } from 'snyk'
✗ import type { DockerScanResult } from 'snyk-docker-plugin'
While this plugin ships its own TypeScript types, they are internal to the Snyk CLI's architecture. Developers typically interact with the Snyk CLI's public API and types, rather than directly with the plugin's internal types. The main interaction is through CLI commands, not direct TypeScript imports.
Demonstrates the installation of the Snyk CLI and how to use the `snyk container test` command with a local or remote Docker image to scan for vulnerabilities, including options for specifying a Dockerfile or excluding application vulnerabilities.
npm install -g snyk
# Authenticate your Snyk CLI with your Snyk account
snyk auth
# Build a sample Docker image (assuming you have a Dockerfile in your current directory)
# For example, create a Dockerfile with:
# FROM node:20-alpine
# WORKDIR /app
# COPY package*.json ./
# RUN npm install
# COPY . .
# CMD ["node", "server.js"]
docker build -t my-vulnerable-app:latest .
# Test your Docker image for vulnerabilities using the Snyk Docker plugin
snyk container test my-vulnerable-app:latest \
--file=./Dockerfile \
--exclude-app-vulns \
--severity-threshold=high
# Alternatively, test a remote image from Docker Hub
snyk container test node:20-alpine
# Scan a local Docker archive
docker save -o my-app.tar my-vulnerable-app:latest
snyk container test --file=./my-app.tar
Debug
Known issues
breakingThe minimum Node.js engine requirement was updated to `>=20.19`. Running the Snyk CLI (and thus this plugin) with older Node.js versions will result in errors.fixUpgrade your Node.js environment to version 20.19 or higher. Use a tool like `nvm` to manage multiple Node.js versions: `nvm install 20 && nvm use 20`.
affects: >=9.0.0 (approx, based on engine requirement)
gotchaThe `snyk-docker-plugin` is not a standalone library for direct programmatic use. Attempting to `import` or `require` it in your Node.js application will lead to errors as its API is internal and exposed solely via the Snyk CLI.fixInteract with Docker image scanning functionality exclusively through the Snyk CLI by running `snyk container test ...` commands in your terminal or CI/CD pipelines.
affects: >=1.0.0
gotchaWhen testing container images, it's crucial to specify the `--file` flag pointing to your Dockerfile for accurate base image detection and recommendations. Omitting it might lead to less precise results.fixAlways include `--file=<path/to/Dockerfile>` when running `snyk container test <IMAGE>` to enable full Dockerfile analysis and improve the accuracy of Snyk's recommendations.
affects: >=1.0.0
deprecatedOlder versions of the Snyk CLI might require specific Docker daemon access or configurations. The plugin has continuously improved its ability to scan images from various sources, including archives or registries without direct daemon access. Relying on direct Docker daemon access for scanning might become less necessary or supported in future versions.fixEnsure you are using the latest Snyk CLI version (`npm install -g snyk@latest`). Explore options like `snyk container test --file=./my-image.tar` or direct registry pulling which reduce dependencies on local Docker daemon setup.
affects: <8.0.0 (approx)
Errors
Common errors & fixes
Error: Node.js v18.x.x is not supported. Please upgrade to Node.js v20.19.x or higher.
The Snyk CLI and its plugins have updated their minimum Node.js version requirement.
fixUpdate your Node.js environment to version 20.19 or newer. Use `nvm install 20` and `nvm use 20` if using Node Version Manager.
Cannot find module 'snyk-docker-plugin'
Attempting to import the plugin as a regular Node.js module.
fixThis package is a CLI plugin, not a library for programmatic import. Use the `snyk container test` command via the Snyk CLI instead of trying to import it directly.
ERROR: Could not find image 'my-image:latest'. Please ensure the image is available locally or in a configured registry.
The specified Docker image is not found in the local Docker daemon or accessible via configured registries.
fixVerify the image name and tag are correct. Ensure the image is pulled locally (`docker pull my-image:latest`) or that the Snyk CLI has correct registry authentication configured (`snyk config set dockerToken=...`).
Permission denied while accessing Docker socket.
The user running the Snyk CLI does not have appropriate permissions to interact with the Docker daemon socket.
fixEnsure your user is part of the `docker` group (`sudo usermod -aG docker $USER && newgrp docker`) or configure Docker daemon access appropriately. If running in CI, ensure the CI runner has necessary Docker permissions.
Audit
Dependencies
snykrequiredThis package is a plugin for the Snyk CLI tool and is not intended for standalone use. The Snyk CLI (npm package 'snyk') is required to utilize its functionality.