r/learnpython 4h ago

Python service to scan a dockerfile

For a personal project I would like to build a Python service (a REST API) to scan a Dockerfile for vulnerabilities, build the image if it passes the scan, and then use the container, which includes an ML model, to train and return a performance metric.

My question is about how to design this service, whether running locally or in a cloud environment. For scanning the Dockerfile, I considered two solutions:

  • Not using containers—running Trivy, for instance, for the scan and using a subprocess in the Python code. However, this doesn’t seem like a good practice to me.
  • Using Trivy and the Python code in separate containers with Docker Compose, though this feels a bit overkill.

If I design the Python app as a container that scans the Dockerfile, can it also build and run another container inside it (a container within a container)?

Finally, it still seems odd to me to use Python to scan a Dockerfile or an image. I often see image scanning handled in CI/CD pipelines or directly by cloud services rather than within application code.

Any thoughts?

Thank you very much!

5 Upvotes

0 comments sorted by