Commands
Every Seal CLI command, its arguments, and the flags specific to it.
The Seal CLI has five top-level commands: seal scan, seal fix, seal image fix, seal add, and seal version. Shared persistent flags applicable to every command live on Global flags.
seal scan [directory]
Discovers vulnerable packages and reports the findings.
Arguments
[directory](optional). The project root to scan. Defaults to the current directory.
Scan-specific flags
--os
off
Scan the OS-package layer of the root filesystem instead of a project directory.
--fs <ecosystem>
unset
Scan filesystem artifacts. Accepted values: java (JAR files), python (Python wheel files).
--csv <path>
unset
Export scan results as CSV to the specified file path.
--generate-actions-file
off
Generate a .seal-actions.yml file populated with the available sealed iterations for each discovered vulnerability.
--generate-snyk-policy
off
Write Seal-attributed ignore entries to .snyk in the same run. Requires --generate-actions-file.
--generate-grype-policy
off
Write Seal-attributed ignore entries to .grype.yaml. Requires --generate-actions-file.
--generate-cycode-policy
off
Write Seal-attributed ignore entries to .cycode/config.yaml. Requires --generate-actions-file.
Examples
seal scan
seal scan ./my-project
seal scan --os
seal scan --fs java
seal scan /path/to/wheels --fs python
seal scan --generate-actions-file
seal scan --generate-actions-file --generate-snyk-policyseal fix [directory]
Applies sealed packages to vulnerable dependencies.
Arguments
[directory](optional). The project root.
Fix-specific flags
--mode <local|remote|all>
local
Fix strategy. local uses .seal-actions.yml, remote uses server-side Sealing Rules, all substitutes every vulnerable package Seal has a sealed version for.
--os
off
Fix OS-level packages of the root filesystem instead of a project directory.
--fs <ecosystem>
unset
Fix filesystem artifacts. Accepted values: java, python.
--silence <pkg@ver>
none
Mark a package version as a false-positive that should be silenced on disk. Repeatable. Not supported in remote mode.
--summarize
off
Write a JSON summary of applied fixes. Default path: seal-summary.json.
--summary-file-path <path>
unset
Custom file path for the fix summary. Used with --summarize.
--junit-summary <path>
unset
Write a JUnit XML summary of sealed packages to the given path.
--skip-sign-checks
off
Skip per-artifact ECDSA signature verification.
--keep-malicious
off
Disable automatic downgrade of malicious packages. By default, the CLI replaces a detected malicious package with the latest safe version; this flag keeps the malicious version in place.
Examples
seal image fix <image>
Pulls a container image, generates a wrapper Dockerfile that runs seal fix --os and seal fix --fs java / inside, builds the result, and pushes it. The pull and push use the host's Docker credentials; the seal step uses SEAL_TOKEN passed in as a BuildKit secret. The CLI runs in all mode internally; the --mode flag does not apply.
Arguments
<image>(required). The fully-qualified reference of the image to seal.
image fix-specific flags
--platform <platform>
yes
(none)
Target platform (linux/amd64, linux/arm64, and so on). Required.
--tag <tag>
no
the source image's reference
Where to push the sealed result. If omitted, the sealed image overwrites the source tag in place.
--squash
no
off
Squash image layers into a single FROM scratch rebuild, preserving image metadata.
Examples
seal add <package> <version>
Adds a fix rule to the project's .seal-actions.yml for one package version without running a full scan and fix. The CLI resolves the safest available sealed iteration for the package version and writes the entry.
Arguments
<package>(required). The package name as the package manager identifies it.<version>(required). The vulnerable version to override.
add-specific flags
--manifest-file <path>
unset
Path to the manifest or lock file to use when resolving the rule.
--fs <ecosystem>
unset
Target a filesystem ecosystem instead of a project manifest. Accepted values: java, python.
--generate-snyk-policy
off
Also write a .snyk entry for the added rule.
--generate-grype-policy
off
Also write a .grype.yaml entry for the added rule.
--generate-cycode-policy
off
Also write a .cycode/config.yaml entry for the added rule.
Examples
seal version
Prints the CLI's version and exits.
Help
Every command accepts --help to print its synopsis, flags, and examples:
Related
Global flags: persistent flags shared across every command.
Last updated