POC: Add Grype vulnerability scanning

[cwage]

Proof-of-concept for container image vulnerability scanning using Grype.

Changes

• Add docker-compose.grype.yml - runs Grype scanner via Docker
• Add scripts/grype-compose.sh - scans all images in a compose file
• Add Makefile targets:
  • make grype IMAGE=<img> - scan a single image
  • make grype-compose - scan all production images
  • make grype-pull - pull the scanner image
• Update README with usage examples

Status

This is a proof-of-concept. The scanning works locally, but CI integration and notification/reporting is not yet implemented.

See #110 for discussion on notification approach (ntfy.sh).

Test Plan

make grype IMAGE=nginx:latest
make grype-compose
make grype-compose GRYPE_ARGS="--fail-on critical"

[Copilot]

Pull request overview

This PR adds Grype vulnerability scanning capability to the homelab repository as a proof-of-concept. It integrates the Anchore Grype container scanner for detecting CVEs in Docker images used in the production stack.

Changes:

• Add Docker Compose service for running Grype scanner with cached vulnerability database
• Add shell script to scan all images referenced in a compose file
• Add Makefile targets for scanning single images, all production images, and pulling the scanner image
• Update README with usage examples and documentation

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
docker-compose.grype.yml	Defines Grype scanner service with Docker socket access and database caching
scripts/grype-compose.sh	Shell script to extract and scan all images from a compose file
Makefile	Add targets for grype, grype-compose, and grype-pull with proper error handling
README.md	Document new scanning commands and provide usage examples

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The unquoted variable $IMAGES in the for loop relies on word splitting which could fail if image names contain spaces or special characters. While uncommon in practice for Docker images, this violates shellcheck best practices. Consider using an array or proper quoting. For example:

while IFS= read -r IMAGE; do
    # loop body
done <<< "$IMAGES"

Or use an array:

mapfile -t IMAGES_ARRAY <<< "$IMAGES"
for IMAGE in "${IMAGES_ARRAY[@]}"; do
    # loop body
done

[Copilot]

The script assumes it's run from the repository root since it references docker-compose.grype.yml without a path. If run from a different directory, it will fail. Consider making the script location-aware by using the script's directory to locate the compose file, or document in the usage comment that it must be run from the repository root.

[Copilot]

The shebang should use #!/usr/bin/env bash for consistency with other scripts in the repository. The scripts at scripts/install-precommit-hook.sh, ansible/scripts/install-precommit-hook.sh, and tofu/scripts/install-precommit-hook.sh all use #!/usr/bin/env bash, which is more portable as it uses the PATH to locate bash rather than assuming it's at /bin/bash.