How to Package Applications in Docker for Contextual Analysis

Use Case

You need binary vulnerability contextual analysis, also called applicability scanning, on container images with JFrog Advanced Security. JFrog Xray runs contextual analysis on Docker and OCI repositories by unpacking image layers and analyzing the code and binaries inside them.

If you scan source code with the JFrog CLI, Frogbot, or an IDE integration, you can enable contextual analysis without Docker. Use this guide when you need applicability results for built artifacts packaged in container images.

Before You Begin

You need the following:

• JFrog Xray with Advanced Security enabled.
• A local or remote Docker or OCI repository in JFrog Artifactory.
• Permission to push images to Artifactory and configure Xray indexed resources.
• For self-hosted environments: outbound network access from Xray to releases-docker.jfrog.io so Advanced Security scanning helper images can be pulled.

Step 1: Package Applications Inside the Container

For contextual analysis to run on a container image, packages and dependencies must be physically present inside image layers. Xray recursively unpacks layers and analyzes embedded files.

If a dependency appears only in a metadata file, such as pom.xml, package.json, or *.csproj, but the physical libraries aren't copied into the image, Xray can't analyze them for contextual analysis. Affected CVEs may show Not Scanned or be omitted from applicability results.

Java with Maven and Gradle

When you package Java applications inside Docker, build a fat JAR or Uber JAR so dependencies are physically archived inside the JAR, then copy that JAR into the image.

For more information, see How to Create an Uber JAR for Contextual Analysis.

JavaScript and npm

Place node_modules and application source inside the image layers.

As a recommended practice, avoid fully minifying or uglifying production JavaScript inside the container when you need contextual analysis. Heavy minification can obfuscate function and variable names and make it harder for the engine to map function calls and determine reachability.

C# and NuGet

Binary contextual analysis for C# and .NET is supported inside Docker and OCI container images. Place compiled executables and *.dll files inside image layers.

When you publish a .NET application, include the full publish output:

• Application binaries, such as *.dll and *.exe
• Dependency manifest file *.deps.json
• Runtime configuration file *.runtimeconfig.json, when applicable

Example Dockerfile:

FROM mcr.microsoft.com/dotnet/runtime:8.0
WORKDIR /app
COPY ./publish/ .

Binary contextual analysis for .NET binaries in Docker requires Xray 3.95.4 or later. For more information, see C# / .NET.

C and C++ with Conan

Place compiled executables and C++ binaries inside image layers so Xray can analyze them during container scanning. Binary contextual analysis for C and C++ is supported inside Docker. For more information, see Supported Technologies.

Step 2: Configure the Platform and Repository

After you package the image correctly, configure the JFrog Platform to analyze it.

Enable Advanced Security on the Docker Repository

Advanced Scans apply to newly added artifacts in the repository by default. For images already in the repository, trigger a one-time advanced scan after you enable contextual analysis.

1. Navigate to Administration > Xray Settings > Indexed Resources.
2. Add the Docker or OCI repository if it isn't already indexed.
3. Select the repository and click Configure.
4. Under Advanced Security, enable the scanners you need:
   • Vulnerabilities Contextual Analysis
   • Secrets
   • Applications
   • Services
5. Under Scope, select Scan all artifacts or Scan by pattern for specific image paths.
6. Save the configuration.

For more information, see Enable Advanced Scans for Repositories.

Self-Hosted Registry Access

On self-hosted environments, Xray must have outbound network access to releases-docker.jfrog.io to pull Advanced Security scanning helper images configured in Xray, including:

• jfrog/xray-jas-contextual-analysis: Contextual analysis scanning image
• jfrog/xray-jas-exposures: Exposures scanning image

These image names are defined in the Xray default configuration (contextualAnalysis.registry and exposures.container.registry).

Step 3: Push the Image and Review Results

1. Build and tag your image for your Artifactory Docker repository.

2. Push the image:

   Shell

   docker push <JFROG_HOSTNAME>/<DOCKER_REPOSITORY>/<IMAGE_NAME>:<TAG>

   Where:

   • <JFROG_HOSTNAME>: The hostname of your JFrog Platform
   • <DOCKER_REPOSITORY>: The Docker or OCI repository key
   • <IMAGE_NAME>: The image name
   • <TAG>: The image tag

   For example:

   Shell

   docker push mycompany.jfrog.io/docker-local/my-app:1.0.0

3. Navigate to Application > Xray > Scans List.

4. Open the scan for your Docker image.

5. Select a CVE and open the Contextual Analysis tab to review applicability status and evidence.

Xray unpacks image layers and scans embedded application dependencies, including NuGet, npm, Maven, Go, and PyPI components. For more information, see Docker / OCI.

Step 4: Run Contextual Analysis Locally

To run contextual analysis on a local image before pushing to Artifactory, use the JFrog CLI with Advanced Security enabled:

jf docker scan <IMAGE_NAME>:<TAG>

Where:

• <IMAGE_NAME>: The name of the local image
• <TAG>: The image tag

For example:

jf docker scan my-app:1.0.0

This command extracts the container locally, runs Advanced Security scanners, including contextual analysis for Docker images, and returns applicability results in your terminal or continuous integration pipeline.

For more information, see Scan Your Binaries.

Try an Optional Demo Image

During a proof of concept, you can pull and scan a prebuilt demo image from the JFrog demo environment:

productdemo.jfrog.io/jas-demo-containers/ics:latest

This image is intended to demonstrate applicable and not applicable contextual analysis findings in the user interface.

Limitations

• Binary contextual analysis support varies by language. For more information, see Supported Technologies.
• NuGet DLL detection inside containers applies to third-party NuGet packages.
• Contextual analysis requires an Advanced Security license and a supported Xray version.
• If a CVE shows Missing Context for a non-container artifact, scanning the same binaries inside a Docker repository on the JFrog Platform can resolve applicability. For more information, see Contextual Analysis of CVEs.

Related Topics

• Enable Advanced Scans for Artifacts
• Enable Advanced Scans
• Create a Contextual Analysis Policy