GreenOps Scan is Now Available as a Docker Image

Run the free CLI without installing Node.js

If you want to try GreenOps Scan but do not want to install Node.js or manage npm versions, the scanner is now available as a Docker image.

You can pull it directly from Docker Hub and run it with a single command. The image contains the same read-only AWS scanner as the CLI version; it simply removes the local install step.

docker pull spidgorny/greenops-scan:latest

Why a container image helps

GreenOps Scan is a free CLI that inspects AWS resource metadata and usage signals for potential cost and carbon savings. It has always been available through npm:

npx greenops-scan

That still works. The Docker image is for teams or environments where a container is more convenient:

• CI runners that do not have Node.js preinstalled
• Shared engineering laptops with locked-down package managers
• Scheduled or cron-based scans in an existing container orchestration setup
• Quick one-off scans in a clean, isolated environment

Because the image is built from the published npm package, it tracks the same release as npx greenops-scan. Pin to a specific version in production, and use latest for quick experiments.

Quick start

Mount your AWS credentials and a reports directory, then run an interactive scan:

docker run --rm -it \
  -v ~/.aws:/home/greenops/.aws:ro \
  -v "$(pwd)/reports:/reports" \
  -e AWS_PROFILE=default \
  spidgorny/greenops-scan:latest \
  --region us-east-1

The container runs as a non-root greenops user. The /home/greenops home directory is the right place for mounted AWS config and credentials. The /reports working directory is where JSON and PDF reports are written, so mount a host directory there if you want to keep the files.

You can also pass AWS credentials through environment variables:

docker run --rm -it \
  -v "$(pwd)/reports:/reports" \
  -e AWS_ACCESS_KEY_ID=... \
  -e AWS_SECRET_ACCESS_KEY=... \
  -e AWS_REGION=us-east-1 \
  spidgorny/greenops-scan:latest

CI and automation

For non-interactive use, set --non-interactive and --format json so the results can be piped to other tools:

docker run --rm \
  -v ~/.aws:/home/greenops/.aws:ro \
  -v "$(pwd)/reports:/reports" \
  -e AWS_PROFILE=default \
  spidgorny/greenops-scan:0.1.34 \
  --region eu-west-1 \
  --format json \
  --quiet \
  --save-report

This writes the full report to stdout and a report.json into the mounted reports directory. Progress and diagnostics are written to stderr, so they never mix with the machine-readable output.

Supported tags

• spidgorny/greenops-scan:latest — the most recent release
• spidgorny/greenops-scan:0.1.34 — a pinned, reproducible version

Pin a version in CI. Use latest for manual, exploratory runs.

Same scanner, same safety model

The Docker image uses the same read-only AWS APIs as the CLI:

• it never modifies, stops, or deletes resources
• credentials stay on the machine that runs the container
• findings are local unless you choose to move the report elsewhere
• it does not install an agent or require write permissions in your account

From a one-off scan to continuous monitoring

A container image makes it easy to add GreenOps Scan to a cron job or a CI pipeline. For teams that want recurring scans, shared dashboards, and scan history, GreenOps Cloud fits on top of the same scanner.

Pull the image and try a scan on a dev or sandbox account:

docker run --rm -it \
  -v ~/.aws:/home/greenops/.aws:ro \
  -v "$(pwd)/reports:/reports" \
  -e AWS_PROFILE=default \
  spidgorny/greenops-scan:latest \
  --region us-east-1

Review the findings with the workload owners before making any changes. If the scanner surfaces useful opportunities, you can make it part of your regular cost and carbon review cadence.

Tags: #AWS #CloudCostOptimization #FinOps #Sustainability #Docker #Container #GreenOps #CloudWaste