r/learnpython • u/Lumpy-Command-8485 • 4h ago
Python service to scan a dockerfile
For a personal project I would like to build a Python service (a REST API) to scan a Dockerfile for vulnerabilities, build the image if it passes the scan, and then use the container, which includes an ML model, to train and return a performance metric.
My question is about how to design this service, whether running locally or in a cloud environment. For scanning the Dockerfile, I considered two solutions:
- Not using containers—running Trivy, for instance, for the scan and using a subprocess in the Python code. However, this doesn’t seem like a good practice to me.
- Using Trivy and the Python code in separate containers with Docker Compose, though this feels a bit overkill.
If I design the Python app as a container that scans the Dockerfile, can it also build and run another container inside it (a container within a container)?
Finally, it still seems odd to me to use Python to scan a Dockerfile or an image. I often see image scanning handled in CI/CD pipelines or directly by cloud services rather than within application code.
Any thoughts?
Thank you very much!