> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/sto-scanner-configuration/security-step-settings-reference.md).

# STO step settings

This document describes a few common settings available for scanners in STO. For a list of supported scanners, see the [Supported Scanners](/security-testing-orchestration/new-to-sto/sto-whats-supported/scanners.md) page.

#### Scanning a Docker image with STO <a href="#scanning-a-docker-image-with-sto" id="scanning-a-docker-image-with-sto"></a>

STO supports two primary ways of scanning a container image; scanning the docker image contained within a Docker-in-Docker background step (requiring privileged mode) or scanning an OCI/Docker archive, which **doesn't need the Docker-in-Docker background step** (this is the recommended approach).

#### Scanning an OCI/Docker archive with STO <a href="#scanning-an-ocidocker-archive-with-sto" id="scanning-an-ocidocker-archive-with-sto"></a>

Scanning an OCI/Docker archive is easier and preferred approach, as it simplifies configuration by removing the need for a Docker-in-Docker background step and reducing security overhead (since privileged mode is not required). STO will automatically scan the OCI/Docker archive without any need for additional DinD configurations.

If you want to force the scanner step **not to use** any Docker-in-Docker(DinD) background step, set the following variable in the Settings section of your step configuration (optional):

* `docker_mode`: `without-docker-in-docker`

This setting is optional and only needed if you want to force the STO to use a specific approach.

The following scanners can perform container scanning without requiring a Docker-in-Docker background step.

<details>

<summary>Scanners that do not require Docker-in-Docker as a background step</summary>

| **Scanner**   | **Do not need DinD** |
| ------------- | -------------------- |
| Anchore       | ✅                    |
| Aqua Security | ✅                    |
| Aqua Trivy    | ✅                    |
| AWS ECR Scan  | ✅                    |
| Black Duck    | DinD is required     |
| Custom Scan   | DinD is required     |
| Grype         | ✅                    |
| Prisma Cloud  | ✅                    |
| Snyk          | ✅                    |
| Sysdig        | ✅                    |
| Wiz           | ✅                    |

</details>

#### Configuring Docker-in-Docker (DinD) for your pipeline <a href="#configuring-docker-in-docker-dind-for-your-pipeline" id="configuring-docker-in-docker-dind-for-your-pipeline"></a>

Here’s how you can set up Docker-in-Docker as a Background step in your pipeline.

<details>

<summary>Set up a Docker-in-Docker background step</summary>

1. Go to the stage where you want to run the scan.
2. In **Overview**, add the shared path `/var/run`.
3. In **Execution**, do the following:
   1. Click **Add Step** and then choose **Background**.
   2. Configure the Background step as follows:

      1. Dependency Name = `dind`
      2. Container Registry = The Docker connector to download the DinD image. If you don't have one defined, go to [Docker connector settings reference](/harness-ai/use-harness-platform/connectors/cloud-providers/ref-cloud-providers/docker-registry-connector-settings-reference.md).

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p>If your container registry uses a <a href="https://en.wikipedia.org/wiki/Self-signed_certificate">self-signed certificate</a>, the background step will not be able to access the registry by default. Refer to <a href="/pages/7mWcEeuFiYp4swpkPXfS#configuring-dind-background-step-to-trust-self-signed-container-registries">Configure DinD Background step to trust self-signed container registries</a> for instructions.</p></div>

      3. Image = `docker:dind`
      4. Under **Entry Point**, add the following: `dockerd`

         In most cases, using `dockerd` is a faster and more secure way to set up the background step. For more information, go to the **TLS** section in the [Docker quick reference](https://hub.docker.com/_/docker).

         If the DinD service doesn't start with `dockerd`, clear the **Entry Point** field and then run the pipeline again. This starts the service with the default [entry point](https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime).
      5. Under **Optional Configuration**, select the **Privileged** checkbox.

Add a Background step to your pipeline and set it up as follows:- step: type: Background name: background-dind-service identifier: Background\_1 spec: connectorRef: CONTAINER\_IMAGE\_REGISTRY\_CONNECTOR image: docker:dind shell: Sh entrypoint: - dockerd privileged: true

</details>

For Orchestrated and Extraction scans, you might want to increase the resource limits for your Docker-in-Docker background step. This can speed up your scan times, especially for large scans. For more information, go to [Optimize STO pipelines](/security-testing-orchestration/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/optimize-sto-pipelines.md).

If you want to force the scanner step to use Docker-in-Docker (DinD) background step, set the following variable in the **Settings** section of your step configuration (optional):

* `docker_mode`: `docker-in-docker`

This setting is optional and only needed if you want to force the STO to use a specific approach.

#### Configuring DinD Background step to trust self-signed container registries <a href="#configuring-dind-background-step-to-trust-self-signed-container-registries" id="configuring-dind-background-step-to-trust-self-signed-container-registries"></a>

When using Docker-in-Docker (DinD) as a background step for scanning container images, the step needs to pull images from your container registry. If your container registry uses a [self-signed certificate](https://en.wikipedia.org/wiki/Self-signed_certificate), the background step will not be able to access it by default. To resolve this issue, you need to add the following command to configure the background step to trust the self-signed container registry.

Following the [DinD configuration](#configuring-docker-in-docker-dind-for-your-pipeline), apply the below settings

1. Set the **Shell** field to **Sh**
2. In the **Command** filed, enter the following command

### Root access requirements for STO <a href="#root-access-requirements-for-sto" id="root-access-requirements-for-sto"></a>

If you want to add trusted certificates to your scan images at runtime, you need to run the scan step with root access.

You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).

### Security steps and scanner templates in STO <a href="#security-steps-and-scanner-templates-in-sto" id="security-steps-and-scanner-templates-in-sto"></a>

The Step library includes a [**Custom Scan**](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) step for setting up scanners: open the step and configure the scan as a set of key/value pairs under **Settings**.

Some scanners also have their own steps with simplified UIs that simplify the setup process.

<details>

<summary>Step Library with scanner-specific steps and Custom Scan step</summary>

![Step Library with scanner-specific steps and Custom Scan step](/files/pnI7MK5xjqvaLlqtSLey)

</details>

<details>

<summary>Custom Scan step configuration</summary>

![Custom Scan step configuration](/files/xLcHbgEB3UuLKuRibZn1)

</details>

<details>

<summary>Scanner-specific step configuration</summary>

![Scanner-specific step configuration](/files/etWnTGROhJGqUPGtWySm)

</details>