Freedom251 › Container Image Scanning Tools

Dagda

Free plan APILinuxSelf-hosted

What Dagda is

Dagda is a free, self-hosted tool for finding security threats in Docker images and containers and monitoring containers while they run. It checks installed operating-system packages and programming-language dependencies against vulnerability and exploit data held in MongoDB. Its dependency analysis covers Java, Python, Node.js, JavaScript, Ruby, and PHP, using OWASP Dependency-Check and Retire.js. ClamAV is used to scan for trojans, viruses, malware, and other malicious threats. For runtime monitoring, Dagda integrates with Falco and collects real-time events from the Docker daemon to identify anomalous activity.

Static-analysis and runtime-monitoring reports are stored in MongoDB, making image and container history available for review. Users can work through a command-line interface or a REST API. Supported Linux image bases include Red Hat, CentOS, Fedora, Debian, Ubuntu, OpenSUSE, and Alpine. Dagda requires Python 3.8 or later, MongoDB 3.6 or later, Docker, and pip3; Falco monitoring also requires host OS kernel headers, and some distributions may need Sysdig installed. A documented Docker Compose arrangement runs Dagda and MongoDB containers with a shared Docker socket. The repository identifies the license as Apache-2.0.

Who it suits

Dagda suits teams that want to inspect Docker images and containers for vulnerabilities and malware, then keep watch on containers at runtime. It is intended for self-hosted use and offers both CLI and REST API access.

What it does well

Scans images and containers for vulnerabilities and malware.
Monitors running containers through Falco integration.
Analyzes dependencies across six listed programming languages.
Stores reports in MongoDB for later history review.
Offers both a CLI and REST API.

What to know first

Requires Python 3.8 or later, MongoDB 3.6 or later, and Docker.
Falco monitoring needs host kernel headers; some distributions may need Sysdig.
Requires self-hosted deployment.

Getting started

Open the Dagda GitHub repository.
Prepare Python 3.8 or later, MongoDB 3.6 or later, Docker, and pip3.
For Falco-based monitoring, provide host OS kernel headers; some distributions may also need Sysdig.
Use the documented Docker Compose setup to run MongoDB and Dagda containers with a shared Docker socket.
Use the CLI or REST API to work with Dagda.

Verdict

Choose Dagda if you need a free, self-hosted Docker security tool combining vulnerability checks, malware scanning, and runtime monitoring. Its operational requirements, including MongoDB and Docker, make it a fit for environments prepared to host and maintain those components.

Questions

Is Dagda free?

Yes. Dagda is listed as free, with a free plan.

What does Dagda analyze?

It checks Docker images and containers for vulnerabilities, malware, and other threats, and monitors running containers for anomalous activity.

Which interfaces does Dagda offer?

Dagda provides a command-line interface and a REST API.

What does Dagda require?

Its requirements include Python 3.8 or later, MongoDB 3.6 or later, Docker, and pip3. Falco monitoring also requires host OS kernel headers.

What license does Dagda use?

The repository identifies Dagda's license as Apache-2.0.

Facts from Dagda's own pages

Base images: The README lists Red Hat/CentOS/Fedora, Debian/Ubuntu, OpenSUSE, and Alpine as supported Linux base images. · github.com, 4 Oct 2026
Dependency coverage: The README lists Java, Python, Node.js, JavaScript, Ruby, and PHP dependencies for analysis using OWASP Dependency-Check and Retire.js. · github.com, 9 Oct 2026
Deployment: The README describes running Dagda as a server and provides a Docker Compose setup with MongoDB and a Dagda container. · github.com, 9 Oct 2026
Deployment requirements: The listed requirements include Python 3.8 or later, MongoDB 3.6 or later, Docker, and host OS kernel headers for Falco monitoring. · github.com, 4 Oct 2026
Docker deployment: The README describes a Docker Compose setup with MongoDB and Dagda containers and a shared Docker socket. · github.com, 4 Oct 2026
Interfaces: Dagda can be used through its CLI and has a REST API. · github.com, 9 Oct 2026
License: The GitHub repository identifies its license as Apache-2.0. · github.com, 9 Oct 2026
Malware detection: It uses ClamAV to detect trojans, viruses, malware, and other malicious threats in Docker images and containers. · github.com, 4 Oct 2026
Malware scanning: Dagda uses ClamAV to detect trojans, viruses, malware, and other malicious threats in Docker images and containers. · github.com, 9 Oct 2026
Purpose: Dagda performs static analysis of Docker images and containers for known vulnerabilities and malicious threats, and monitors running containers for anomalous activities. · github.com, 9 Oct 2026
Report history: Analysis reports, including static analysis and runtime monitoring, are stored in MongoDB for later review. · github.com, 9 Oct 2026
Reports: Analysis reports, including static analysis and runtime monitoring, are stored in MongoDB so image and container history can be reviewed. · github.com, 4 Oct 2026
Requirements: The README requires Python 3.8 or later, MongoDB 3.6 or later, Docker, and pip3. · github.com, 9 Oct 2026
REST API: The README says Dagda has a REST API in addition to its command-line interface. · github.com, 4 Oct 2026
Runtime monitoring: Dagda integrates with Falco to monitor running Docker containers and gathers real-time events from the Docker daemon. · github.com, 9 Oct 2026
Runtime prerequisite: The README says host OS kernel headers are required for Falco-based monitoring and notes that Sysdig installation may be needed on some distributions. · github.com, 9 Oct 2026
Support: The README directs users to GitHub Issues or the author's Twitter account for bugs, questions, and discussions. · github.com, 9 Oct 2026
Supported image bases: The README lists Red Hat/CentOS/Fedora, Debian/Ubuntu, OpenSUSE, and Alpine as supported Linux base images. · github.com, 9 Oct 2026
Vulnerability analysis: It checks installed OS packages and programming-language dependencies against vulnerability and exploit data stored in MongoDB. · github.com, 9 Oct 2026

Where Dagda stands on Freedom251

Container Image Scanning Tools#6 of 29