I am currently trying to simulate creating a container that scans containers for compliance against DISA STIG profiles. This job will eventually make it into a CI/CD pipeline. Disclaimer here: I am new to DevOps so my responses might not be as knowledgeable as they could be hehe. I am doing this using a MacBook with Docker installed. I created a Redhat/UBI8 docker container and then within that container I installed podman on it and created a container image there using podman pull. I did “podman save” and created a .tar file with it. No matter if I unzip or leave the image as is, I always get the same result after scanning. Each rule returns “notapplicable” as the result. The funny thing is that I know I’m running it with the proper profile. I scanned RHEL8 images, Debian, Ubunutu, and they all return the same. What could I do to fix this? Should I go about scanning a container within a container a different way?

Steps I took to run the job locally on my Macbook