Building a Docker Compose security audit pipeline using Trivy and Dockle with automated Slack notifications for CVE detection

Why I Built a Docker Security Pipeline

I run multiple Docker containers across my self-hosted infrastructure—everything from n8n automation to Synology services. Over time, I noticed something uncomfortable: I had no systematic way to know when vulnerabilities appeared in my images. I'd rebuild containers occasionally, but only when I remembered to check for updates.

That reactive approach felt wrong. If a critical CVE dropped in a base image I was using, I wanted to know immediately—not weeks later when I happened to rebuild. I needed automated scanning that would alert me without requiring manual checks.

My Setup: Trivy, Dockle, and Slack

I chose Trivy for vulnerability scanning because it's fast, comprehensive, and actually maintained. It scans both OS packages and application dependencies, which matters when you're running custom images with multiple layers.

I added Dockle for Docker best practices—things like checking if images run as root, whether secrets are baked in, or if unnecessary ports are exposed. Trivy finds CVEs; Dockle catches configuration mistakes.

For notifications, I use Slack. I already have channels for monitoring alerts, so adding security findings there made sense. Email would get buried; Slack gets seen.

The Docker Compose Structure

I run this as a scheduled service using Cronicle (my job scheduler), but the core is a Docker Compose setup that scans images and sends results to Slack.

version: '3.8'

services:
  security-scanner:
    image: aquasec/trivy:latest
    container_name: security-scanner
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./scan-results:/results
      - ./scripts:/scripts:ro
    environment:
      - SLACK_WEBHOOK=${SLACK_WEBHOOK}
    command: /scripts/scan-and-notify.sh
    restart: "no"

The scanner mounts the Docker socket to access running containers, writes results to a local directory, and runs a custom script that handles both scanning and notification.

The Scanning Script

This script does the actual work. It scans all running containers, runs Dockle checks, and formats findings for Slack.

#!/bin/bash
set -euo pipefail

RESULTS_DIR="/results"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
SLACK_WEBHOOK="${SLACK_WEBHOOK:-}"

# Create results directory
mkdir -p "$RESULTS_DIR"

# Get list of running containers
CONTAINERS=$(docker ps --format '{{.Image}}' | sort -u)

if [ -z "$CONTAINERS" ]; then
    echo "No running containers found"
    exit 0
fi

# Initialize summary
CRITICAL_COUNT=0
HIGH_COUNT=0
TOTAL_ISSUES=0

# Scan each container
while IFS= read -r IMAGE; do
    echo "Scanning $IMAGE..."
    
    # Trivy scan
    TRIVY_OUTPUT="$RESULTS_DIR/trivy_${IMAGE//\//_}_$TIMESTAMP.json"
    trivy image \
        --severity CRITICAL,HIGH \
        --format json \
        --output "$TRIVY_OUTPUT" \
        "$IMAGE" || true
    
    # Count vulnerabilities
    if [ -f "$TRIVY_OUTPUT" ]; then
        CRITICAL=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="CRITICAL")] | length' "$TRIVY_OUTPUT")
        HIGH=$(jq '[.Results[]?.Vulnerabilities[]? | select(.Severity=="HIGH")] | length' "$TRIVY_OUTPUT")
        
        CRITICAL_COUNT=$((CRITICAL_COUNT + CRITICAL))
        HIGH_COUNT=$((HIGH_COUNT + HIGH))
        
        if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
            TOTAL_ISSUES=$((TOTAL_ISSUES + 1))
            echo "  Found: $CRITICAL CRITICAL, $HIGH HIGH"
        fi
    fi
    
    # Dockle scan
    DOCKLE_OUTPUT="$RESULTS_DIR/dockle_${IMAGE//\//_}_$TIMESTAMP.json"
    dockle --format json --output "$DOCKLE_OUTPUT" "$IMAGE" || true
    
done <<< "$CONTAINERS"

# Send Slack notification if issues found
if [ "$TOTAL_ISSUES" -gt 0 ] && [ -n "$SLACK_WEBHOOK" ]; then
    SLACK_MESSAGE=$(cat <

SLACK_WEBHOOK=https://hooks.slack.com/services/YOUR/WEBHOOK/URL

{
  "title": "Docker Security Scan",
  "enabled": 1,
  "timing": {
    "hours": [2],
    "minutes": [0]
  },
  "plugin": "shellplug",
  "params": {
    "script": "cd /opt/security-scanner && docker compose up --abort-on-container-exit"
  }
}