anchorectl stig
STIG related operations.
Every command on this page also accepts the global flags.
Subcommands
- stig docker — Docker related STIG operations
- stig write-profiles — Write Anchore STIG profiles to disk.
stig docker
Docker related STIG operations.
anchorectl stig docker [command]
Subcommands
- stig docker image — Docker image related STIG operations
stig docker image
Docker image related STIG operations.
anchorectl stig docker image [command]
Subcommands
- stig docker image add — Add a STIG evaluation for an image
- stig docker image delete — Delete a STIG evaluation for an image
- stig docker image download — Download a STIG evaluation for an image
- stig docker image execute — Perform a STIG evaluation generation for an image
- stig docker image list — List the STIG evaluation metadata for an image
stig docker image add
Add a STIG evaluation for an image.
anchorectl stig docker image add IMAGE STIG_EVALUATION_FILE [flags]
Arguments
| Argument | Description |
|---|---|
IMAGE | The image ID, name:tag, name@sha256:digest, name:tag@sha256:digest, or sha256:digest value. |
STIG_EVALUATION_FILE | The path and filename for the STIG evaluation file. |
Flags
| Flag | Type | Environment variable | Default | Required | Description |
|---|---|---|---|---|---|
-o, --output | string | ANCHORECTL_FORMAT | text | No | The format to show the results. Allowable values: text, json, json-raw, id. See Output Formats. |
--stig-evaluation-uuid | string | ANCHORECTL_STIG_EVALUATION_UUID | "" | No | The UUID for the STIG evaluation to overwrite, if the image already has a STIG evaluation for the same profile this must be provided to upload the new evaluation. |
stig docker image delete
Delete a STIG evaluation for an image.
anchorectl stig docker image delete IMAGE EVALUATION_UUID [flags]
Aliases: del
Arguments
| Argument | Description |
|---|---|
EVALUATION_UUID | The UUID of the STIG evaluation. |
IMAGE | The image ID, name:tag, name@sha256:digest, name:tag@sha256:digest, or sha256:digest value. |
Flags
| Flag | Type | Environment variable | Default | Required | Description |
|---|---|---|---|---|---|
-o, --output | string | ANCHORECTL_FORMAT | text | No | The format to show the results. Allowable values: text, json, json-raw, id. See Output Formats. |
stig docker image download
Download a STIG evaluation for an image.
anchorectl stig docker image download IMAGE EVALUATION_UUID [flags]
Arguments
| Argument | Description |
|---|---|
EVALUATION_UUID | The UUID of the STIG evaluation. |
IMAGE | The image ID, name:tag, name@sha256:digest, name:tag@sha256:digest, or sha256:digest value. |
Flags
| Flag | Type | Environment variable | Default | Required | Description |
|---|---|---|---|---|---|
--stig-output-dir | string | ANCHORECTL_STIG_OUTPUT_DIR | "" | No | Directory to save the STIG evaluation. |
stig docker image execute
Perform a STIG evaluation generation for an image.
anchorectl stig docker image execute IMAGE [flags]
Arguments
| Argument | Description |
|---|---|
IMAGE | Fully qualified image reference in format [registry/]repository/image:tag@digest. |
Flags
| Flag | Type | Environment variable | Default | Required | Description |
|---|---|---|---|---|---|
-p, --stig-profile | string | ANCHORECTL_STIG_PROFILE | "" | Yes | Path to the Inspec STIG profile, can be a folder containing the extracted profile or an archive e.g. .tar.gz (required). |
--platform | string | ANCHORECTL_PLATFORM | "" | No | An optional platform specifier used when pulling the image into the docker daemon (e.g. linux/arm64, linux/amd64). Set this when the daemon cannot select an entry from a multi-arch image index on its own (optional). |
--stig-container-manual-override | string | ANCHORECTL_STIG_CONTAINER_MANUAL_OVERRIDE | "" | No | Docker container ID to use as the STIG target (skips creating container with anchore-keep-alive binary). |
-i, --stig-input-file | string (repeatable) | ANCHORECTL_STIG_INPUT_FILE | [] | No | Path to input file to use for STIG generation. The input file can optionally provide variable inputs to the STIG profile that can change the execution of specific controls (optional). |
--stig-output-dir | string | ANCHORECTL_STIG_OUTPUT_DIR | "" | No | Path to save the STIG evaluation (optional). |
--stig-skip-upload | bool | ANCHORECTL_STIG_SKIP_UPLOAD | false | No | Skip uploading the STIG evaluation to Anchore (optional). |
--stig-tools-binary-path | string | ANCHORECTL_STIG_TOOLS_BINARY_PATH | "" | No | Path to the statically-linked busybox binary inside the tools image (default: /bin/busybox). |
--stig-tools-image | string | ANCHORECTL_STIG_TOOLS_IMAGE | "" | No | Container image containing a statically-linked busybox binary for shell-less image support (e.g. docker.io/library/busybox:musl). The binary must be statically linked to work in distroless containers. |
--stig-waiver-file | string (repeatable) | ANCHORECTL_STIG_WAIVER_FILE | [] | No | Path to waiver file to use for STIG generation. The waiver file can waive controls and dictate the running and/or reporting of those controls (optional). |
stig docker image list
List the STIG evaluation metadata for an image.
anchorectl stig docker image list IMAGE [flags]
Arguments
| Argument | Description |
|---|---|
IMAGE | The image ID, name:tag, name@sha256:digest, name:tag@sha256:digest, or sha256:digest value. |
Flags
| Flag | Type | Environment variable | Default | Required | Description |
|---|---|---|---|---|---|
-o, --output | string | ANCHORECTL_FORMAT | text | No | The format to show the results. Allowable values: text, json, json-raw, id. See Output Formats. |
stig write-profiles
Write Anchore STIG profiles to disk.
anchorectl stig write-profiles PATH [flags]
Arguments
| Argument | Description |
|---|---|
PATH | Path to write the profiles to. |