Background
Found while manually testing --compose against examples/compose/docker-compose-insecure.yml with images not pulled locally. When a per-service image scan fails inside ComposeOrchestrator.run_full_scan (docksec/compose_scanner.py, around lines 387-432), the failure is only logged via logger.error(...), which is invisible by default in CLI mode (logger defaults to ERROR-and-up on stderr, but even then a user running without -v/DOCKSEC_LOG_LEVEL won't see it prominently — see #129 for adding -v). The scan otherwise completes and reports a security score as if every service's image had actually been scanned, which can be misleading: a user could believe the compose scan was comprehensive when some services silently only got static rule checks, not real vulnerability data.
Task
When one or more services fail to scan (image not found locally, scanner exception, etc.), surface this clearly in the CLI's user-facing output — not just the debug log. For example, add a line to the "Quick take" block (see docksec/output.py's quick_take) like:
- 2 of 3 services could not be scanned (image not found locally): web, db
Acceptance criteria
Pointers
docksec/compose_scanner.py:387-432 — where per-service scans run and failures are caughtdocksec/output.py — quick_take/_render_scan_summary equivalent renderingdocksec/cli.py — where the compose result gets rendered after the scan
Background
Found while manually testing
--composeagainstexamples/compose/docker-compose-insecure.ymlwith images not pulled locally. When a per-service image scan fails insideComposeOrchestrator.run_full_scan(docksec/compose_scanner.py, around lines 387-432), the failure is only logged vialogger.error(...), which is invisible by default in CLI mode (logger defaults to ERROR-and-up on stderr, but even then a user running without-v/DOCKSEC_LOG_LEVELwon't see it prominently — see #129 for adding-v). The scan otherwise completes and reports a security score as if every service's image had actually been scanned, which can be misleading: a user could believe the compose scan was comprehensive when some services silently only got static rule checks, not real vulnerability data.Task
When one or more services fail to scan (image not found locally, scanner exception, etc.), surface this clearly in the CLI's user-facing output — not just the debug log. For example, add a line to the "Quick take" block (see
docksec/output.py'squick_take) like:- 2 of 3 services could not be scanned (image not found locally): web, dbAcceptance criteria
ComposeOrchestrator.run_full_scantracks which services failed and why (not just a booleanall_success)cli.pyui.warn/ui.detail(not just the raw logger)tests/test_compose_scanner.pystill pass; add a test asserting the failed-service info is present in the returned resultsPointers
docksec/compose_scanner.py:387-432— where per-service scans run and failures are caughtdocksec/output.py—quick_take/_render_scan_summaryequivalent renderingdocksec/cli.py— where the compose result gets rendered after the scan