DependencyCheck Docker & Self-Hosted Deployment

GitHub

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

7,581 stars Java Java 1 file · ~3,796 tokens #ant-task#build-tool#gradle-plugin#jenkins-plugin#maven-plugin#security#security-audit#software-composition-analysis
1. Pull Image (DOCKERHUB) docker pull dependency-check/DependencyCheck:latest
2. Docker Run (1-Click Launch) docker run -d --name dependencycheck --restart always dependency-check/dependencycheck:latest
3. Podman Run podman run -d --name dependencycheck --restart always dependency-check/dependencycheck:latest
4. Skopeo Inspect (Zero-Pull Manifest) skopeo inspect docker://docker.io/dependency-check/dependencycheck:latest
5. ORAS Pull (OCI Artifact) oras pull dependency-check/dependencycheck:latest
Dockerfile 
FROM golang:1.27.1-alpine AS go

FROM azul/zulu-openjdk-alpine:25 AS jlink

RUN "$JAVA_HOME/bin/jlink" --compress=zip-6 --module-path /opt/java/openjdk/jmods --add-modules java.base,java.compiler,java.datatransfer,jdk.crypto.ec,java.desktop,java.instrument,java.logging,java.management,java.naming,java.rmi,java.scripting,java.security.sasl,java.sql,java.transaction.xa,java.xml,jdk.unsupported,jdk.net --output /jlinked

FROM mcr.microsoft.com/dotnet/runtime:8.0-alpine

ARG VERSION
ARG POSTGRES_DRIVER_VERSION
ARG MYSQL_DRIVER_VERSION
ARG MAVEN_REPOSITORY_URL="https://repo1.maven.org/maven2"
ARG UID=1000
ARG GID=1000

ENV user=dependencycheck
ENV JAVA_HOME=/opt/jdk
ENV JAVA_OPTS="-Danalyzer.assembly.dotnet.path=/usr/bin/dotnet -Danalyzer.bundle.audit.path=/usr/bin/bundle-audit -Danalyzer.golang.path=/usr/local/go/bin/go"
ENV ODC_NAME=dependency-check-docker
ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=false

COPY --from=jlink /jlinked /opt/jdk/
COPY --from=go /usr/local/go/ /usr/local/go/

ADD cli/target/dependency-check-${VERSION}-release.zip /

RUN apk upgrade --no-cache                                                                           && \
    apk add --no-cache --virtual .build-deps curl                                                    && \
    apk add --no-cache git ruby npm                                                                  && \
    gem install --no-document bundler-audit                                                          && \
    npm install --global --ignore-scripts corepack                                                   && \
    unzip dependency-check-${VERSION}-release.zip -d /usr/share/                                     && \
    rm dependency-check-${VERSION}-release.zip                                                       && \
    cd /usr/share/dependency-check/plugins                                                           && \
    curl -fSLO "${MAVEN_REPOSITORY_URL}/org/postgresql/postgresql/${POSTGRES_DRIVER_VERSION}/postgresql-${POSTGRES_DRIVER_VERSION}.jar"    && \
    curl -fSLO "${MAVEN_REPOSITORY_URL}/com/mysql/mysql-connector-j/${MYSQL_DRIVER_VERSION}/mysql-connector-j-${MYSQL_DRIVER_VERSION}.jar" && \
    addgroup -S -g ${GID} ${user} && adduser -S -D -u ${UID} -G ${user} ${user}                      && \
    mkdir /usr/share/dependency-check/data                                                           && \
    chown -R ${user}:0 /usr/share/dependency-check                                                   && \
    chmod -R g=u /usr/share/dependency-check                                                         && \
    mkdir /report                                                                                    && \
    chown -R ${user}:0 /report                                                                       && \
    chmod -R g=u /report                                                                             && \
    apk del .build-deps                                                                              && \
    rm -rf /tmp/* /root/.cache /root/.npm

### remove any suid sgid - we don't need them
RUN find / -path /proc -prune -perm +6000 -type f -exec chmod a-s {} \;
USER ${UID}

### Cache pieces needed for the specific run user
RUN bundle audit update                                                                              && \
    corepack prepare pnpm@latest yarn@latest --activate                                              && \
    printf "enableTelemetry: false\nenableScripts: false\n" >> ${HOME}/.yarnrc.yml                   && \
    rm -rf /tmp/*

VOLUME ["/src", "/report"]

WORKDIR /src

CMD ["--help"]
ENTRYPOINT ["/usr/share/dependency-check/bin/dependency-check.sh"]