Skip to content

Container Quick Start

Use this guide for a controlled, non-interactive Linux runtime with PostQ, Java, and OpenGrep included in one image.

Typical time: 10 minutes. Requires Docker 24+ or Podman 4.8+, an issued license, and either internet access or a platform-matched OCI archive.

1. Confirm the deployment requirements

Have an issued postq.lic available. A connected host can pull the published beta image directly. For an offline host, obtain a platform-matched OCI archive before installation. Java and OpenGrep are already included in the image.

2. Install a container runtime

Use your organization's approved software distribution process, or install one runtime from its publisher:

Then run the supplied pre-install check:

.\postq-code-scanner-preinstall-check.ps1 -Profile container

If PowerShell blocks the script, see PowerShell blocks the prerequisite checker.

bash ./postq-code-scanner-preinstall-check.sh --profile container

Confirm the runtime is started. For offline installation, confirm the archive matches linux/amd64 or linux/arm64 for the host.

For platform notes and supported versions, see Prerequisites.

3. Pull or load the image

On a host with internet access, pull the published beta image. The run command in step 5 also pulls it automatically when it is not already present.

docker pull postqsoftwarelabs/postqcodescanner:0.1.0-Beta

podman pull postqsoftwarelabs/postqcodescanner:0.1.0-Beta

For an offline host, transfer the platform-matched archive and load it instead:

docker load --input postq-code-scanner-cli-oci-image-<version>.tar

podman load --input postq-code-scanner-cli-oci-image-<version>.tar

The load command prints the image name stored in the archive. If it differs from the published beta name used in step 5, use the loaded image name in the run command.

4. Prepare mounts

Create three separate host paths:

  • source/ contains the repository and is mounted read-only;
  • reports/ receives generated reports and the persistent local license ledger;
  • postq.lic is mounted read-only and is not stored in either directory.

Download and extract the Java Quick Start project, then use the extracted postq-java-quickstart directory as source/. The sample does not need to be compiled before scanning.

5. Run the first scan

docker run --rm \
  -v "$PWD/source:/repo:ro" \
  -v "$PWD/reports:/reports:rw" \
  -v "$PWD/postq.lic:/run/secrets/postq.lic:ro" \
  postqsoftwarelabs/postqcodescanner:0.1.0-Beta \
  --license-accepted \
  --license-file /run/secrets/postq.lic

podman run --rm \
  -v "$PWD/source:/repo:ro" \
  -v "$PWD/reports:/reports:rw" \
  -v "$PWD/postq.lic:/run/secrets/postq.lic:ro" \
  postqsoftwarelabs/postqcodescanner:0.1.0-Beta \
  --license-accepted \
  --license-file /run/secrets/postq.lic

6. Copy the report viewer

The container image includes the standalone viewer. Copy it into the generated report folder after the scan:

docker create --name postq-viewer-copy postqsoftwarelabs/postqcodescanner:0.1.0-Beta
docker cp postq-viewer-copy:/opt/postq/postq-code-scanner-cli/report-viewer/index.html ./reports/index.html
docker rm postq-viewer-copy

podman create --name postq-viewer-copy postqsoftwarelabs/postqcodescanner:0.1.0-Beta
podman cp postq-viewer-copy:/opt/postq/postq-code-scanner-cli/report-viewer/index.html ./reports/index.html
podman rm postq-viewer-copy

7. Confirm success

  • The container exits 0.
  • The review reports exist under reports/.
  • reports/index.html exists if you copied the packaged viewer.

Next: Container Runner and Report Viewer Quick Start.