IaC scan

Catch infrastructure misconfiguration in the files, before anything is applied to a cluster.

Infrastructure scanning reads the definition files in a repository and reports misconfiguration in the file that declares it, with the line to change. It runs entirely locally — nothing is applied, deployed or connected to, so it is safe against production manifests.

Run it

Point it at a directory or a single file:

$ sentrasec iac .

Output is human-readable by default; add a format for machines:

$ sentrasec iac . --format json$ sentrasec iac . --format sarif

Every finding names the file and line, so a scan of a mixed repository tells you which manifest to open:

output

[Critical] K8S001 — container runs privileged; disables kernel isolation (k8s/pod.yaml:1)[High]     K8S002 — container may run as root (runAsNonRoot not true) (k8s/pod.yaml:1)[Medium]   DOCKERFILE007 — FROM uses :latest or no tag; image contents are unpinned (Dockerfile:1)sentrasec: iac findings=7 crit=1 high=2 med=3 exit=0

What it reads

Dockerfiles, Kubernetes manifests, Terraform, CloudFormation, Bicep, Helm charts, Pulumi and GitOps definitions. Files are matched by shape rather than by name, so a Kubernetes manifest is recognised wherever it lives in the tree.

The rule tables below cover the Dockerfile and Kubernetes families, which are the deepest today.

Dockerfile rules

Rule	Fires on	Why it matters
`DOCKERFILE001`	Runs as root	No USER directive, so the image runs privileged by default.
`DOCKERFILE002`	No HEALTHCHECK	The orchestrator cannot tell a hung container from a healthy one.
`DOCKERFILE003`	Overly permissive mode	chmod 777 and friends inside the build.
`DOCKERFILE004`	Insecure download	Piping a fetched script straight into a shell.
`DOCKERFILE005`	Image bloat	Build tooling left in the final layer.
`DOCKERFILE006`	Secret in ENV	A credential baked into an environment variable.
`DOCKERFILE007`	:latest or untagged	Image contents are unpinned and can change under you.
`DOCKERFILE008`	ADD from URL	Remote content added without checksum verification.

Kubernetes rules

Rule	Fires on	Why it matters
`K8S001`	Privileged container	Disables kernel isolation outright.
`K8S002`	May run as root	runAsNonRoot is not set to true.
`K8S003`	Writable root filesystem	readOnlyRootFilesystem is not set.
`K8S004`	No resource limits	One container can starve the whole node.
`K8S005`	Privilege escalation allowed	allowPrivilegeEscalation is not false.
`K8S006`	Dangerous capability	Capabilities such as SYS_ADMIN or NET_RAW.
`K8S007`	Host network	The pod shares the node network namespace.
`K8S008`	Host PID	The pod can see every process on the node.
`K8S009`	Wildcard RBAC	A role granting * on resources or verbs.

Fail a build on it

--fail-on sets exit code 3 at or above the severity you name, which is what a CI step keys off. Everything else exits 0.

$ sentrasec iac . --fail-on high

Use --format sarif to publish results into GitHub code scanning, so misconfiguration shows up as an annotation on the pull request that introduced it.

Through the API

The command above scans locally and prints. To record results against a registered app so they appear in the console with history, run it through the API instead:

$ sentrasec scan --kind iac --app-id app_...

See Run a scan for the app id and app key contract.