Multi Container Scanning (Apps, Services) CyfroAgent can perform scans on containerized webapps and services if they are in the same Docker network and have a shared volume to scan files for fingerprinting. Prerequisites 1. One or more application containers are already running 2. Docker is installed and accessible 3. You have a valid CyfroAgent token Architecture ``text Docker Network [ Application Containers ] |-- expose services (e.g., 80, 8080) |-- optionally write scanable files [ Shared Volume ] |-- stores code/dependency/configuration files [ CyfroAgent Container ] |-- performs network scans |-- performs filesystem scans via mounted volume ` Network Configuration CyfroAgent must run on the same Docker network as the application containers. Identify the existing network: `bash docker inspect --format '{{json .NetworkSettings.Networks}}' ` Example output: `json { "sample-webapp_default": {} } ` Create the network (if required). If your containers are not already on a shared network: `bash docker network create cyfro-network ` Attach containers: `bash docker network connect cyfro-network ` Note: The CyfroAgent has to be part of the network that you wish to scan. Please connect it to the network(s) where your desired containers are already present. Shared Volume Configuration Filesystem scanning requires a shared volume accessible by both the application container with write access and CyfroAgent with read-only access. Create the volume: `bash docker volume create webapp_scan_export ` Place the necessary files in the shared volume. Mount the volume in the application container. If using docker run: `bash docker run -d \ --name \ --network \ -v webapp_scan_export:/opt/demo-data \ ` If using docker-compose: `yaml services: app: image: volumes: - webapp_scan_export:/opt/demo-data volumes: webapp_scan_export: ` Deploying CyfroAgent Run CyfroAgent with network access to application containers and read-only access to the shared volume. `bash docker run -d \ --name cyfro-agent \ --network \ --cap-add NET_RAW \ --cap-add=NET_ADMIN \ -v cyfro-agent-data:/data/agent \ -v /:/host:ro \ -v webapp_scan_export:/scan-target:ro \ cyfrosec/cyfro-agent:latest \ --agentName "Agent1" \ --token "" \ --fernet-key "your-fernet-key" \ --location "MyLocation" ` Note: Please specify the file path to the shared volume in the Scan Setups page to perform scans. Verification Verify the volume mount: `bash docker exec -it cyfro-agent ls /scan-target ` Compare with: `bash docker exec -it ls /opt/demo-data ` Verify network connectivity: `bash docker network inspect ` Determining Scan Targets Identify the subnet that can be provided when scans are set up in the Scans Setup page. Example: `text "Subnet": "172.22.0.0/16" ``