Is docker-exec-sh a Docker image security scanner?

No. It executes the script you give it and does not scan images for vulnerabilities on its own. To scan, write a script that runs trivy or grype inside that scanner image, or use a dedicated scanning node.

Can it run one script across several images at once?

Yes. image-list takes one image per line and the script runs in each, useful for comparing tool versions or checking base images in one run.

What output does docker-exec-sh produce?

A FOLDER collected from the run. Downstream nodes read it like any other file output, so the script results flow into the rest of the workflow.

Does docker-exec-sh take command-line flags?

No. The node exposes two file inputs, image-list and script-to-be-executed, and no flags. All behavior comes from the script; the source image sets the environment and binaries.

Updated Jul 14, 2026

Utilities

Wrap a container-only tool as a workflow step

Execute a custom shell script inside one or more Docker images.

Wrap a container-only tool as a node Run one script across many images Chain a container tool into recon or scanning

overview

What docker-exec-sh does

docker-exec-sh takes an image-list and a script-to-be-executed file, runs that script inside each image, and collects whatever it writes into a FOLDER.

Reach for it when a tool ships only as a container and has no dedicated node. The script owns the behavior: install, scan, transform, or chain commands in the image environment.

One image-list can fan the same script across multiple images, useful for comparing tool versions or checking a set of base images in a single pass.

source github.com/trickest/containers

use cases

Where docker-exec-sh fits

Wrap a container-only tool as a node

Point the script at an image's binary and run it in place, so a tool that ships only as a Docker image becomes a reusable workflow step with folder output.

Run one script across many images

Feed an image-list to run the same script against each image, handy for comparing tool versions or checking a set of base images in a single pass.

Chain a container tool into recon or scanning

Run a container-only scanner or parser mid-workflow and hand its output folder to the next node, with no rebuild of that tool as a native node.

Prototype before building a native node

Test a tool's command line inside its own image first, then promote it to a dedicated node once the workflow shape has settled.

reference

docker-exec-sh inputs and flags

2 inputs

Name	Type	Flag	Description
image-list	FILE	·	List of Docker images, one per line, where the script runs.
script-to-be-executed	FILE	·	Shell script executed inside each image from the list.

Showing key inputs. docker-exec-sh exposes 2 inputs in total.

example

Run docker-exec-sh

docker-exec-sh · command

# docker-exec-sh runs script-to-be-executed inside each image in image-list# image-list:  trickest/nuclei:latest# script-to-be-executed:nuclei -u https://example.com -severity critical,high -o /output/findings.txt

sample output

[docker-exec-sh] image-list: 2 images[docker-exec-sh] trickest/httpx:latest -> running scripthttps://example.com [200] [Example Domain] [nginx]https://staging.example.com [200] [Staging] [nginx][docker-exec-sh] trickest/httpx:v1.6.0 -> running scripthttps://example.com [200] [Example Domain] [nginx][docker-exec-sh] collected output/  (2 images, exit 0)

guidance

Choosing docker-exec-sh

Use docker-exec-sh when the tool you need ships as a Docker image and has no native node. Write the script, list the image, and collect the FOLDER output. Prefer a dedicated node when one already exists for cleaner inputs and outputs.

assert-tool

Utilities helper for workflow checks. docker-exec-sh runs an arbitrary container command, not a check.

anew

Stream utility for deduplicating lines. Sibling utility for a narrower job.

faq

docker-exec-sh questions

Put the commands in script-to-be-executed, list the image in image-list, and docker-exec-sh runs the script inside that image. There are no flags; both inputs are files.

Run docker-exec-sh yourself

An image list and a script feed docker-exec-sh, which runs the script inside each image and writes the collected output as a queryable folder.

Run docker-exec-sh in Trickest Browse the library

Facts on this page come from the live Trickest tool library.