Dagda combined several container-security tasks in one workflow: inspecting images for known vulnerabilities or malware and integrating monitoring of running Docker containers. It was useful for teams seeking both pre-deployment checks and signals from runtime behavior. Those tasks depend on different tools and data sources, so replacing Dagda may require more than one component. Its historical purpose is clear, but current deployment support has not been established here.
Current guidance
Dagda’s repository was unarchived at review, but current maintenance and deployment support have not been established.
The recovered project combined image analysis with runtime-related integrations. Its last observed repository push was in 2023; that is a reason to investigate, not enough to declare an official retirement.
Break the required capability into package scanning, malware checks and runtime monitoring, then compare current tools for each task. Do not assume one scanner replaces the entire historical workflow. Verify dependencies and trust boundaries before running the old service.
Historical upstream link check · 2026-10-09
The recorded upstream address responded successfully (HTTP 200) on 2026-10-09. GitHub does not mark eliasgranderubio/dagda archived or disabled; this does not establish active maintenance, support or compatibility. Link availability does not certify the historical installation instructions or current security support.
Website availability is separate from project, chart and image support. Use the current guidance and primary sources on this page to assess the distribution.
Historical Kubedex content
Preserved for context. Commands, versions, prices and results below reflect the original research.
Dagda is a tool to perform static analysis of known vulnerabilities, trojans, viruses, malware & other malicious threats in docker images/containers and to monitor the docker daemon and running docker containers for detecting anomalous activities.
In order to fulfill its mission, first the known vulnerabilities as CVEs (Common Vulnerabilities and Exposures), BIDs (Bugtraq IDs), RHSAs (Red Hat Security Advisories) and RHBAs (Red Hat Bug Advisories), and the known exploits from Offensive Security database are imported into a MongoDB to facilitate the search of these vulnerabilities and exploits when your analysis are in progress.
Then, when you run a static analysis of known vulnerabilities, Dagda retrieves information about the software installed into your docker image, such as the OS packages and the dependencies of the programming languages, and verifies for each product and its version if it is free of vulnerabilities against the previously stored information into the MongoDB. Also, Dagda uses ClamAV as antivirus engine for detecting trojans, viruses, malware & other malicious threats included within the docker images/containers.
Dagda supports multiple Linux base images:
- Red Hat/CentOS/Fedora
- Debian/Ubuntu
- OpenSUSE
- Alpine
Dagda rests on OWASP dependency check + Retire.js for analyzing multiple dependencies from:
- java
- python
- nodejs
- js
- ruby
- php
On the other hand, Dagda is integrated with Sysdig Falco for monitoring running docker containers to detect anomalous activities. Also, Dagda includes the gathering of real time events from docker daemon.
Finally, each analysis report of a docker image/container, included all static analysis and all runtime monitoring, is stored into the same MongoDB for having available the history of each docker image/container when it is needed.
Sources & further reading
Spotted something that needs another look?
Help improve this page →