> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/security-step-settings-reference.md).

# STO step settings

This document describes a few common settings available for scanners in STO. For a list of supported scanners, see the [Supported Scanners](/security-testing-orchestration/3.0/new-to-sto/sto-whats-supported/scanners.md) page.

#### Scanning a Docker image with STO <a href="#scanning-a-docker-image-with-sto" id="scanning-a-docker-image-with-sto"></a>

STO supports two primary ways of scanning a container image; scanning the docker image contained within a Docker-in-Docker background step (requiring privileged mode) or scanning an OCI/Docker archive, which **doesn't need the Docker-in-Docker background step** (this is the recommended approach).

#### Scanning an OCI/Docker archive with STO <a href="#scanning-an-ocidocker-archive-with-sto" id="scanning-an-ocidocker-archive-with-sto"></a>

Scanning an OCI/Docker archive is easier and preferred approach, as it simplifies configuration by removing the need for a Docker-in-Docker background step and reducing security overhead (since privileged mode is not required). STO will automatically scan the OCI/Docker archive without any need for additional DinD configurations.

If you want to force the scanner step **not to use** any Docker-in-Docker(DinD) background step, set the following variable in the Settings section of your step configuration (optional):

* `docker_mode`: `without-docker-in-docker`

This setting is optional and only needed if you want to force the STO to use a specific approach.

The following scanners can perform container scanning without requiring a Docker-in-Docker background step.

#### Configuring Docker-in-Docker (DinD) for your pipeline <a href="#configuring-docker-in-docker-dind-for-your-pipeline" id="configuring-docker-in-docker-dind-for-your-pipeline"></a>

Here’s how you can set up Docker-in-Docker as a Background step in your pipeline.

For Orchestrated and Extraction scans, you might want to increase the resource limits for your Docker-in-Docker background step. This can speed up your scan times, especially for large scans. For more information, go to [Optimize STO pipelines](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/optimize-sto-pipelines.md).

If you want to force the scanner step to use Docker-in-Docker (DinD) background step, set the following variable in the **Settings** section of your step configuration (optional):

* `docker_mode`: `docker-in-docker`

This setting is optional and only needed if you want to force the STO to use a specific approach.

#### Configuring DinD Background step to trust self-signed container registries <a href="#configuring-dind-background-step-to-trust-self-signed-container-registries" id="configuring-dind-background-step-to-trust-self-signed-container-registries"></a>

When using Docker-in-Docker (DinD) as a background step for scanning container images, the step needs to pull images from your container registry. If your container registry uses a [self-signed certificate](https://en.wikipedia.org/wiki/Self-signed_certificate), the background step will not be able to access it by default. To resolve this issue, you need to add the following command to configure the background step to trust the self-signed container registry.

Following the [DinD configuration](#configuring-docker-in-docker-dind-for-your-pipeline), apply the below settings

1. Set the **Shell** field to **Sh**
2. In the **Command** filed, enter the following command

### Root access requirements for STO <a href="#root-access-requirements-for-sto" id="root-access-requirements-for-sto"></a>

### Security steps and scanner templates in STO <a href="#security-steps-and-scanner-templates-in-sto" id="security-steps-and-scanner-templates-in-sto"></a>

The Step library includes a [**Custom Scan**](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) step for setting up scanners: open the step and configure the scan as a set of key/value pairs under **Settings**.

Some scanners also have their own steps with simplified UIs that simplify the setup process.

<details>

<summary>Step Library with scanner-specific steps and Custom Scan step</summary>

</details>

<details>

<summary>Custom Scan step configuration</summary>

</details>

<details>

<summary>Scanner-specific step configuration</summary>

</details>