Monitoring Dockle Container Image Linting with Vigilmon

Dockle is an open-source container image linter that checks images against CIS Docker benchmarks and Dockerfile best practices. It catches vulnerabilities like hardcoded credentials, running containers as root, and missing HEALTHCHECK instructions before they reach production. But Dockle only helps if it's actually running — and that's where Vigilmon comes in. Monitor your CI pipelines, image build webhooks, and registry scanning jobs so a broken Dockle integration doesn't leave your images unscanned.

What You'll Set Up

• Cron heartbeat to confirm Dockle scans are executing on schedule
• HTTP monitor for a Dockle scan results API or dashboard if your team runs one
• Webhook monitor to confirm image-pushed events trigger Dockle scans
• Alert channel so security teams get paged when scanning goes silent

Prerequisites

• Dockle installed in your CI pipeline or as part of a registry scanning workflow
• A free Vigilmon account
• Shell access to your CI runner or build machine

Step 1: Add a Heartbeat to Your Dockle Scan Job

The most direct way to confirm Dockle is running is to ping a Vigilmon heartbeat at the end of each successful scan.

1. Log in to vigilmon.online and click Add Monitor.
2. Select Cron Heartbeat.
3. Set the expected interval to match how often your images are built — for example, 60 minutes if you have hourly CI builds.
4. Copy the heartbeat URL: https://vigilmon.online/heartbeat/abc123.

Add the ping to your scan script or CI step:

#!/bin/bash
set -e

IMAGE=$1

echo "Running Dockle against $IMAGE..."
dockle --exit-code 1 "$IMAGE"

echo "Dockle passed — pinging Vigilmon heartbeat"
curl -s "https://vigilmon.online/heartbeat/abc123"

In a GitHub Actions workflow:

- name: Lint container image with Dockle
  run: |
    docker run --rm goodwithtech/dockle:latest \
      --exit-code 1 \
      ${{ env.IMAGE_NAME }}

- name: Ping Vigilmon heartbeat
  if: success()
  run: curl -s https://vigilmon.online/heartbeat/abc123

If Dockle fails or the pipeline crashes before pinging, Vigilmon alerts after the expected interval. You'll know immediately that images are shipping without security checks.

Step 2: Monitor Your Image Registry Webhook Receiver

Many teams wire Dockle into a webhook receiver that fires when images are pushed to a container registry (Docker Hub, ECR, GCR, etc.). Monitor that receiver with an HTTP check so you know if the service is down.

1. In Vigilmon, click Add Monitor → HTTP / HTTPS.
2. Enter your webhook receiver's health endpoint: https://scanner.internal.example.com/health.
3. Set Check interval to 5 minutes.
4. Set Expected HTTP status to 200.
5. Click Save.

If your webhook receiver doesn't have a health endpoint, add one. Here's a minimal Node.js example:

// Express webhook receiver with health check
app.get('/health', (req, res) => {
  res.json({ status: 'ok', scanner: 'dockle', uptime: process.uptime() });
});

app.post('/webhook/image-push', async (req, res) => {
  const { image } = req.body;
  await runDockle(image);
  res.json({ scanned: image });
});

A downed webhook receiver means no image gets scanned until someone notices. Vigilmon catches it within minutes.

Step 3: Watch the Dockle Results Store

If your team aggregates Dockle scan results in a database or internal dashboard, expose a summary endpoint and monitor it. This confirms not just that scans run, but that results are being recorded.

# Flask results API
@app.route('/api/dockle/latest')
def latest_scan():
    result = db.query("SELECT * FROM scans ORDER BY scanned_at DESC LIMIT 1")
    if not result:
        return {'status': 'no scans'}, 503
    age_minutes = (datetime.utcnow() - result.scanned_at).seconds // 60
    if age_minutes > 120:
        return {'status': 'stale', 'age_minutes': age_minutes}, 503
    return {'status': 'ok', 'image': result.image, 'age_minutes': age_minutes}

Add a Vigilmon HTTP monitor for this endpoint with Expected HTTP status 200. If no scan has run in two hours the endpoint returns 503, triggering an alert.

Step 4: Set Up a TCP Monitor for Your Registry

Dockle pulls image layers from your container registry to inspect them. If the registry is unreachable, Dockle will fail — but silently if your pipeline doesn't surface the exit code properly.

Add a TCP monitor for your registry's port:

1. In Vigilmon, click Add Monitor → TCP.
2. Enter your registry host and port: registry.example.com : 443.
3. Set Check interval to 1 minute.
4. Click Save.

For Docker Hub or public registries you don't control, skip TCP and rely on your heartbeat monitor instead — if Docker Hub is down, the heartbeat silence tells you all you need.

Step 5: Configure Alert Channels and Escalation

Security scanning failures need to reach the right people immediately.

1. Go to Alert Channels in Vigilmon.
2. Add your security team's Slack channel, email list, or PagerDuty integration.
3. On the heartbeat monitor, set Consecutive missed pings before alert to 1 — a single missed heartbeat from a security scanner should page immediately.
4. On the HTTP monitors, set Consecutive failures to 2 to avoid noise from brief restarts.

For a registry integration, you can also use the Vigilmon API to create a maintenance window during planned registry migrations:

curl -X POST https://vigilmon.online/api/maintenance \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -d '{"monitor_id": "abc123", "duration_minutes": 30}'

Step 6: Validate the Full Pipeline End-to-End

Build and push a test image to confirm the monitoring chain works:

# Build a test image
docker build -t test-scan:latest .

# Run Dockle locally to confirm it passes
dockle test-scan:latest

# Push to trigger registry webhook
docker push registry.example.com/test-scan:latest

Within your configured interval you should see:

• Webhook receiver health check: green
• Dockle results endpoint: showing the latest scan
• Heartbeat: reset by the CI ping

If any step is missing, you'll know before the next production image ships.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Cron heartbeat | CI scan job | Dockle not running in CI | | HTTP health | Webhook receiver | Scanner service down | | HTTP health | Results API | Scans running but not recorded | | TCP | Container registry | Registry unreachable (Dockle fails silently) |

Dockle gives your images a security baseline — but only if it's actually scanning every build. Vigilmon ensures your Dockle integration is healthy, alerting you the moment a scan goes missing so insecure images never slip through unnoticed.