> ## Documentation Index
> Fetch the complete documentation index at: https://docs.flexagon.com/llms.txt
> Use this file to discover all available pages before exploring further.

# scanLocalImage (Anchore)

> This operation will scan a locally built docker image and return the scan results as plugin outputs. The scan report will also be saved in the reports

This operation will scan a locally built docker image and return the scan results as plugin outputs. The scan report will also be **saved in the reports directory as ScanResults.json** so it can be viewed later on.

# Inputs

<table><colgroup><col /><col /><col /><col /></colgroup><tbody><tr><th>**Input Name**</th><th>**Input Code**</th><th>**Required**</th><th>**Description**</th></tr><tr><td>Image Name</td><td>`FDANCR_INP_IMAGE_NAME`</td><td>Yes</td><td>The full image tag of the locally built image you want to scan. For example **ubuntu:16.06** or **myuser/myimage:latest**</td></tr><tr><td>Groovy Fail Condition</td><td>`FDANCR_INP_SCAN_FAIL_CONDITION`</td><td>No</td><td>Optional groovy script to determine if the scan should fail the workflow. Available variables include all FlexDeploy environment variables and the following scan result variables:<ul><li>STATUS</li><li>FINAL\_ACTION</li><li>STOP\_COUNT</li><li>WARN\_COUNT</li><li>ALL\_COUNTS</li></ul>See more information [here ](https://docs.flexagon.com/flexdeploy-11-2-documentation/flexdeploy-plugin-guides/flexdeploy-anchore-plugin-guide.md)for configuring the Groovy Fail Condition.</td></tr><tr><td>Policy File</td><td>`FDANCR_INP_POLICY_FILE`</td><td>No</td><td>A custom Anchore Policy Bundle to set your own scan/analysis metrics. See Defining Custom Policy Bundles below.</td></tr><tr><td>Scan Timeout</td><td>`FDANCR_INP_TIMEOUT`</td><td>No</td><td>By default the scan will timeout if it exceeds 900 seconds (15min). This is likely more than enough time but the timeout can be increased here if needed.</td></tr></tbody></table>

# Outputs

Each operation in this plugin supplies the option to configure a Groovy script to determine if the scan results are inacceptable and should fail the operation. Below is a list of variables available to the Groovy script.

> [!NOTE]
>
> Each of these variables is also available as a plugin output

<table><colgroup><col /><col /><col /><col /></colgroup><tbody><tr><th>**Groovy Variable**</th><th>**Plugin Output**</th><th>**Description**</th><th>**Example**</th></tr><tr><td>STATUS</td><td>`FDANCR_OUT_STATUS`</td><td>Overall status of the scan/analysis. This is ultimately determined by the policy bundle that is used. Possible values are **pass** or **fail**.</td><td>fail</td></tr><tr><td>FINAL\_ACTION</td><td>`FDANCR_OUT_FINAL_ACTION`</td><td>Similar to the status, this provides the recommended action for the image.</td><td>stop</td></tr><tr><td>STOP\_COUNT</td><td>`FDANCR_OUT_STOP_COUNT`</td><td>An integer count of the number of STOP rules detected for the image</td><td>2</td></tr><tr><td>WARN\_COUNT</td><td>`FDANCR_OUT_WARN_COUNT`</td><td>An integer count of the number of WARN rules detected for the image</td><td>10</td></tr><tr><td>ALL\_COUNTS</td><td>`FDANCR_OUT_ALL_COUNT_LIST`</td><td>A full list of all counts returned</td><td>\[STOP:2, WARN:10, GO:37]</td></tr><tr><td /><td /><td>All other FlexDeploy Variables are also available in the Groovy Script Condition</td><td /></tr></tbody></table>

### Example Groovy Script Conditions

* The most common use case lets the policy bundle unequivocally determine failure.

  ```
  STATUS == "fail"
  ```

* No warn or stop checks found

  ```
  (STOP_COUNT + WARN_COUNT) != 0
  ```

* A script that is more lenient on non-master stream builds (could be only master stream is pushed to the registry and other streams are for local testing).

  ```
  //master is not allowed any stop checks whereas every other stream can have 5 or less
  FDBLD_STREAM_NAME == "master" ? STOP_COUNT > 0 : STOP_COUNT > 5
  ```

# Artifacts

This operation delegates the consume/produce artifacts decision to the workflow developer.

# Endpoint Selection

This operation delegates the selection to the workflow developer to determine.

# Endpoint Execution

This operations delegates the execution to the workflow developer to decide.

# Special Considerations

### Defining Custom Policy Bundles

You can define your own scanning criteria by creating a json file following these [specifications](https://docs.anchore.com/current/docs/engine/general/concepts/policy/bundles/). After creating the custom policy you have two main options:

1. Store the policy json in source control next to your Dockerfile

   * In this case your Policy File input will look like the following:

   * ![image-20240328-201252.png](https://mintcdn.com/flexagon-llc-ce77a95c/NkeZh5D-Nf8j_WaD/images/fd111/12590932939.png?fit=max\&auto=format\&n=NkeZh5D-Nf8j_WaD\&q=85\&s=d2779918758358387166f8c303b12e24)

2. Store the policy json in an absolute location on your docker build server. This can be useful if you want all of your images to use the same policy bundle.

   * ![image-20240328-201450.png](https://mintcdn.com/flexagon-llc-ce77a95c/NkeZh5D-Nf8j_WaD/images/fd111/12590932942.png?fit=max\&auto=format\&n=NkeZh5D-Nf8j_WaD\&q=85\&s=a329032183cfc2654a64c0f007a1cb3c)