Give the scan
its own boundary.

Docker: use the signed release image

Docker mode is opt-in. Start Docker Desktop on macOS or Windows, or Docker Engine on Linux, and verify the daemon responds todocker version. Releases with Docker support include repyy-sandbox-image.txt with the exact image reference and digest. Run repyy version, open the matching release, and use its published digest. Do not substitute mutable latest.

Verify the image signature

FollowReleases and Verification to authenticate the image and binary before use. Repyy checks that the pinned image is present locally; it does not verify signatures during a scan.

A missing daemon or pinned image is a preflight error; repyy never silently falls back to host mode. Checkout deletion failures mark scans incomplete while preserving findings. Credential-file and forced-container cleanup failures also surface as errors.

Docker with a local folder

repyy requests a read-only input mount and --network none for the analysis container, and writes bounded JSON back to the host. The host validates the result and writes the final report.

Keep output in a narrow directory and treat it as sensitive local review data.

Docker with an HTTPS remote

An HTTPS remote uses a disposable networked fetch stage for a shallow clone. A separate analysis stage receives no Git credentials and requests --network none. The host validates the bounded result before rendering the report.

Private HTTPS access uses GITHUB_TOKEN, GITLAB_TOKEN, or BITBUCKET_TOKEN from the scanner environment. Tokens do not enter the clone URL or report. Docker rejects SSH URLs.

Know the edge cases

For multiple targets, one failed target remains visible asSCAN INCOMPLETE while successful targets retain their findings.