Updated Jul 14, 2026

Utilities

Wrap a container-only tool as a workflow step

Execute a custom shell script inside one or more Docker images.

Shell

Agent

overview

What docker-exec-sh does

docker-exec-sh takes an image-list and a script-to-be-executed file, runs that script inside each image, and collects whatever it writes into a FOLDER.

Reach for it when a tool ships only as a container and has no dedicated node. The script owns the behavior: install, scan, transform, or chain commands in the image environment.

One image-list can fan the same script across multiple images, useful for comparing tool versions or checking a set of base images in a single pass.

source github.com/trickest/containers

use cases

Where docker-exec-sh fits

Wrap a container-only tool as a node

Point the script at an image's binary and run it in place, so a tool that ships only as a Docker image becomes a reusable workflow step with folder output.

Run one script across many images

Feed an image-list to run the same script against each image, handy for comparing tool versions or checking a set of base images in a single pass.

Chain a container tool into recon or scanning

Run a container-only scanner or parser mid-workflow and hand its output folder to the next node, with no rebuild of that tool as a native node.

Prototype before building a native node

Test a tool's command line inside its own image first, then promote it to a dedicated node once the workflow shape has settled.

reference

docker-exec-sh inputs and flags

2 inputs
NameTypeFlagDescription
image-listFILE·List of Docker images, one per line, where the script runs.
script-to-be-executedFILE·Shell script executed inside each image from the list.

Showing key inputs. docker-exec-sh exposes 2 inputs in total.

example

Run docker-exec-sh

docker-exec-sh · command
# docker-exec-sh runs script-to-be-executed inside each image in image-list
# image-list:  trickest/nuclei:latest
# script-to-be-executed:
nuclei -u https://example.com -severity critical,high -o /output/findings.txt
sample output
[docker-exec-sh] image-list: 2 images
[docker-exec-sh] trickest/httpx:latest -> running script
https://example.com [200] [Example Domain] [nginx]
https://staging.example.com [200] [Staging] [nginx]
[docker-exec-sh] trickest/httpx:v1.6.0 -> running script
https://example.com [200] [Example Domain] [nginx]
[docker-exec-sh] collected output/  (2 images, exit 0)

guidance

Choosing docker-exec-sh

Use docker-exec-sh when the tool you need ships as a Docker image and has no native node. Write the script, list the image, and collect the FOLDER output. Prefer a dedicated node when one already exists for cleaner inputs and outputs.

assert-tool

Utilities helper for workflow checks. docker-exec-sh runs an arbitrary container command, not a check.

anew

Stream utility for deduplicating lines. Sibling utility for a narrower job.

faq

docker-exec-sh questions

Put the commands in script-to-be-executed, list the image in image-list, and docker-exec-sh runs the script inside that image. There are no flags; both inputs are files.

No. It executes the script you give it and does not scan images for vulnerabilities on its own. To scan, write a script that runs trivy or grype inside that scanner image, or use a dedicated scanning node.

Yes. image-list takes one image per line and the script runs in each, useful for comparing tool versions or checking base images in one run.

A FOLDER collected from the run. Downstream nodes read it like any other file output, so the script results flow into the rest of the workflow.

No. The node exposes two file inputs, image-list and script-to-be-executed, and no flags. All behavior comes from the script; the source image sets the environment and binaries.

Run docker-exec-sh yourself

An image list and a script feed docker-exec-sh, which runs the script inside each image and writes the collected output as a queryable folder.

Facts on this page come from the live Trickest tool library.