Container Runner

The container image provides non-interactive Linux scans with Java, OpenGrep, packaged rules, and the scanner runtime in one artifact. Use separate source, report, and license mounts.

Load the image

docker load --input postq-code-scanner-cli-oci-image-<version>.tar

Use podman load for Podman. Confirm that the archive platform matches the runtime host: linux/amd64 for x86 or linux/arm64 for ARM.

Run with hardened defaults

DockerPodman

docker run --rm \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --pids-limit 512 \
  --memory 4g \
  --cpus 2 \
  --tmpfs /tmp:rw,nosuid,nodev,size=512m \
  -v "$PWD/source:/repo:ro" \
  -v "$PWD/reports:/reports:rw" \
  -v "$PWD/postq.lic:/run/secrets/postq.lic:ro" \
  postq-code-scanner-cli:latest \
  --license-accepted \
  --license-file /run/secrets/postq.lic

podman run --rm \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  --pids-limit 512 \
  --memory 4g \
  --cpus 2 \
  --tmpfs /tmp:rw,nosuid,nodev,size=512m \
  -v "$PWD/source:/repo:ro" \
  -v "$PWD/reports:/reports:rw" \
  -v "$PWD/postq.lic:/run/secrets/postq.lic:ro" \
  postq-code-scanner-cli:latest \
  --license-accepted \
  --license-file /run/secrets/postq.lic

The image supplies /repo as the project and /reports as the output location. It keeps AI disabled so container output follows the deterministic pipeline.

License acceptance and activation

These are separate controls:

• --license-accepted records the caller's non-interactive acceptance representation.
• --license-file supplies the signed trial entitlement required to scan.

The writable report mount preserves the local license ledger under /reports/.postq/. Do not bake licenses into derived images or store them in a public CI variable.

Container command options

The container uses the same scanner-service command model as the native CLI, with /repo as the project and /reports as the output location.

Option	Container behavior
--license-accepted	Required non-interactive representation that the caller accepted the applicable product terms
--license-file <path>	Path to the signed trial inside the container, normally /run/secrets/postq.lic
--name <name>	Project name stored in generated reports
--version <version>	Scanned application version stored in generated reports
--language <lang>	Programming-language hint for the mounted source
--license	Display packaged product license and terms, then exit
--notices	Display packaged third-party notices and source information, then exit

--license-accepted does not replace the signed trial supplied through --license-file. For shared scanner option semantics and exit behavior, see Command Line.

Review packaged legal text without starting a scan:

docker run --rm postq-code-scanner-cli:latest --license
docker run --rm postq-code-scanner-cli:latest --notices

Runtime security properties

The final image runs as a non-root user, starts through a Java entrypoint, keeps application files read-only, and removes common interactive shell and package-management tools. Runtime hardening does not protect an image archive from someone who can pull or export it. Restrict registry and archive access and use supplied integrity, SBOM, security-scan, and signature evidence where available.

Common mount issues

• Use absolute host paths in managed CI environments.
• Ensure the report directory exists and is writable by the container's non-root identity.
• On Windows and macOS, make the source/report locations available to the runtime's Linux VM.
• On SELinux hosts, apply the organization-approved volume-label option if required.