Documentation — Rustmaninoff

Why Rustmaninoff over Checkov and Trivy

Checkov and Trivy are broader platforms. Rustmaninoff is a small attribute scanner for CI when you already know the CKV ids to enforce.

Speed. 20 ms on 1,540 resources vs 4.51 s Checkov (~225×) and 5.71 s Trivy (~285×). No Python interpreter, no policy-db refresh on the scan path.
One static binary. Checkov needs a Python environment. Trivy also covers vulns, secrets, and SBOMs that an IaC-only job may not want.
Checkov-shaped policies, Rust engine. Published CKV ids, YAML pass-conditions, and # checkov:skip= / checkov.io/skip. Not a Python port of Checkov.
Predictable CI. Interpolations are unknown, never fail. SARIF 2.1.0, JUnit, JSON, --fail-on.
Focused catalog. 181 attribute checks, each with pass and fail fixtures. No graph checks, Helm, Kustomize, plan JSON, or secrets/vuln scanning—use Checkov or Trivy for that surface.

Install

Requires Rust 1.95 or newer.

cargo install rustmaninoff --locked
rustmaninoff scan .

From a checkout:

cargo build --release -p rustmaninoff
./target/release/rustmaninoff scan .

GitHub Release binaries for Linux and macOS (amd64 and arm64) are attached to v0.2.0.

Scan

rustmaninoff scan [PATH] \
  --framework terraform,cloudformation,kubernetes,docker \
  --check CKV_AWS_3 \
  --skip-check CKV_AWS_8 \
  --output cli,json,sarif,junit \
  --fail-on HIGH \
  --external-checks-dir ./extra

PATH defaults to the current directory.
--output defaults to cli. Also: json, sarif, junit, plus --json-file, --sarif-file, --junit-file.
--fail-on is LOW, MEDIUM, HIGH, or CRITICAL. Default HIGH.
--soft-fail always exits 0. --show-unknown prints unknown results. --show-passed prints passed checks. --compact shortens the text report.

Exit codes: 0 when nothing fails the threshold, 1 when a finding is at or above --fail-on or a file fails to parse, 2 on usage errors.

Interpolations (${...}, Fn::*, !Ref, !GetAtt) are unknown. Unknown results do not fail the process.

Config

Optional .rustmaninoff.yaml in the scan path, or --config:

frameworks: [terraform, cloudformation, kubernetes, docker]
skip_checks: []
fail_on: HIGH
excluded_paths: []
external_checks_dirs: []
show_unknown: false
compact: false

Directories named .git, .terraform, .terragrunt-cache, node_modules, vendor, and target are skipped. Symbolic links are not followed.

Policies

A check definition is the pass condition. Built-in policies are rewritten YAML, attributed to Checkov (Bridgecrew / Palo Alto Networks, Apache-2.0), and reuse published CKV ids.

Operators: equals, not_equals, exists, not_exists, contains, not_contains, within, regex_match, starting_with, ending_with, numeric comparisons, is_true, is_false, is_empty, length_greater_than, length_less_than, and their negated forms. Combinators: and, or, not.

Extensions: no_element, forbid_resource, equals_any, intersects, image_tag_pinned, and missing: pass|fail|unknown. scope is ignored. Severity defaults to MEDIUM when omitted.

Example

metadata:
  id: CKV_DOCKER_1
  name: Ensure the base image uses a non-latest tag
  category: SUPPLY_CHAIN
  severity: HIGH
  framework: docker
resource_types:
- dockerfile
definition:
  cond_type: attribute
  attribute: FROM.unpinned
  operator: is_false

Drop extra YAML in --external-checks-dir. Each built-in check ships with pass and fail fixtures.

Skips

Inline: # checkov:skip=CKV_AWS_3:reason.

Kubernetes annotation value: checkov.io/skip: CKV_K8S_16=reason.

v0.2 scope

Terraform .tf / .tf.json managed resource blocks and data sources (IR kind data, type data.TYPE). No module download and no full HCL evaluation.
CloudFormation YAML and JSON Resources. Attribute paths are relative to Properties.
Kubernetes multi-document YAML, including List.
Dockerfiles: FROM, USER, ADD vs COPY, HEALTHCHECK, and privileged-ish RUN patterns.
181 built-in checks: 94 Terraform, 51 CloudFormation, 32 Kubernetes, 4 Docker.
Text, JSON, SARIF 2.1.0, and JUnit reports.

S3 encryption, versioning, and logging on current Terraform target aws_s3_bucket_server_side_encryption_configuration, aws_s3_bucket_versioning, and aws_s3_bucket_logging. CKV_AWS_286 matches a static action subset, including * and *:*. CKV_K8S_14 accepts a digest or a tag other than latest; an image whose last colon is a registry port and which has no tag is treated as pinned.

Not in 0.2: graph checks (CKV2_*), Terraform plan JSON, remote modules, Helm, Kustomize, secrets scanning, full variable evaluation, and cfn-lint resource-spec validation.

CI

- uses: actions/checkout@v4
- run: cargo install --path crates/cli --locked
- run: rustmaninoff scan . --fail-on HIGH --output sarif --sarif-file rustmaninoff.sarif

Or install a released crate: cargo install rustmaninoff --locked --version 0.2.0.

Crates

Workspace 0.2.0 on crates.io:

API docs: docs.rs/rustmaninoff.

Limits

Files larger than 10 MB, and files past the nesting or YAML-alias limits, are reported as diagnostics and are not parsed.

Using Rustmaninoff