CyfroAgent can perform scans on containerized webapps and services if they are in the same Docker network and have a shared volume to scan files for fingerprinting.
Prerequisites
- One or more application containers are already running
- Docker is installed and accessible
- You have a valid CyfroAgent token
Architecture
Docker Network [ Application Containers ] |-- expose services (e.g., 80, 8080) |-- optionally write scanable files [ Shared Volume ] |-- stores code/dependency/configuration files [ CyfroAgent Container ] |-- performs network scans |-- performs filesystem scans via mounted volume
Network Configuration
CyfroAgent must run on the same Docker network as the application containers.
Identify the existing network:
docker inspect <container_name> --format '{{json .NetworkSettings.Networks}}'
Example output:
{ "sample-webapp_default": {} }
Create the network (if required). If your containers are not already on a shared network:
docker network create cyfro-network
Attach containers:
docker network connect cyfro-network <container_name>
Note: The CyfroAgent has to be part of the network that you wish to scan. Please connect it to the network(s) where your desired containers are already present.
Shared Volume Configuration
Filesystem scanning requires a shared volume accessible by both the application container with write access and CyfroAgent with read-only access.
Create the volume:
docker volume create webapp_scan_export
Place the necessary files in the shared volume.
Mount the volume in the application container. If using docker run:
docker run -d \ --name <app_container> \ --network <network_name> \ -v webapp_scan_export:/opt/demo-data \ <image>
If using docker-compose:
services: app: image: <image> volumes: - webapp_scan_export:/opt/demo-data volumes: webapp_scan_export:
Deploying CyfroAgent
Run CyfroAgent with network access to application containers and read-only access to the shared volume.
docker run -d \ --name cyfro-agent \ --network <network_name> \ --cap-add NET_RAW \ --cap-add=NET_ADMIN \ -v cyfro-agent-data:/data/agent \ -v /:/host:ro \ -v webapp_scan_export:/scan-target:ro \ cyfrosec/cyfro-agent:latest \ --agentName "Agent1" \ --token "<TOKEN>" \ --fernet-key "your-fernet-key" \ --location "MyLocation"
Note: Please specify the file path to the shared volume in the Scan Setups page to perform scans.
Verification
Verify the volume mount:
docker exec -it cyfro-agent ls /scan-target
Compare with:
docker exec -it <app_container> ls /opt/demo-data
Verify network connectivity:
docker network inspect <network_name>
Determining Scan Targets
Identify the subnet that can be provided when scans are set up in the Scans Setup page.
Example:
"Subnet": "172.22.0.0/16"