Skip to content

Container Quick Start

Use this guide for a controlled, non-interactive Linux runtime with Java, OpenGrep, packaged rules, and scanner-service included in one image.

Typical time: 10 minutes. Requires Docker 24+ or Podman 4.8+, a platform-matched OCI archive, and an issued license.

1. Confirm the deployment requirements

Have a platform-matched OCI archive and an issued postq.lic available. The host requires Docker or Podman; Java and OpenGrep are already included in the image.

2. Install a container runtime

Use your organization's approved software distribution process, or install one runtime from its publisher:

Then run the supplied pre-install check:

.\postq-code-scanner-preinstall-check.ps1 -Profile container

bash ./postq-code-scanner-preinstall-check.sh --profile container

Confirm the runtime is started and the archive matches linux/amd64 or linux/arm64 for the host.

For platform notes and supported versions, see Prerequisites.

3. Load the image

docker load --input postq-code-scanner-cli-oci-image-<version>.tar

podman load --input postq-code-scanner-cli-oci-image-<version>.tar

4. Prepare mounts

Create three separate host paths:

  • source/ contains the repository and is mounted read-only;
  • reports/ receives generated reports and the persistent local license ledger;
  • postq.lic is mounted read-only and is not stored in either directory.

Download and extract the Java Quick Start project, then use the extracted postq-java-quickstart directory as source/. The sample does not need to be compiled before scanning.

5. Run the first scan

docker run --rm \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --pids-limit 512 \
  --memory 4g \
  --cpus 2 \
  --tmpfs /tmp:rw,nosuid,nodev,size=512m \
  -v "$PWD/source:/repo:ro" \
  -v "$PWD/reports:/reports:rw" \
  -v "$PWD/postq.lic:/run/secrets/postq.lic:ro" \
  postq-code-scanner-cli:latest \
  --license-accepted \
  --license-file /run/secrets/postq.lic

podman run --rm \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --pids-limit 512 \
  --memory 4g \
  --cpus 2 \
  --tmpfs /tmp:rw,nosuid,nodev,size=512m \
  -v "$PWD/source:/repo:ro" \
  -v "$PWD/reports:/reports:rw" \
  -v "$PWD/postq.lic:/run/secrets/postq.lic:ro" \
  postq-code-scanner-cli:latest \
  --license-accepted \
  --license-file /run/secrets/postq.lic

6. Confirm success

  • The container exits 0.
  • reports/manifest.json lists the generated artifacts.
  • The three primary review reports exist under reports/.
  • reports/.postq/ is preserved for license ledger continuity.
  • Source remains unchanged and the license is not copied into reports.

Next: Container Runner and Report Viewer Quick Start.