Bare Docker image for ZAP API Scan

zap-api-scan.dockerfile

FROM owasp/zap2docker-bare

# Enable installing packages
USER root

ENV ZAP_SOURCE="https://raw.githubusercontent.com/zaproxy/zaproxy/master" \
    ZAP_PLUGINS="https://github.com/zaproxy/zap-extensions/releases/download"

RUN apk add --no-cache py-pip \
  && pip install zapcli \
  \
  && mkdir -p /home/zap/.ZAP_D/scripts/scripts/httpsender \
  && wget -P /home/zap/.ZAP_D/scripts/scripts/httpsender \
       "$ZAP_SOURCE/docker/scripts/scripts/httpsender/Alert_on_HTTP_Response_Code_Errors.js" \
       "$ZAP_SOURCE/docker/scripts/scripts/httpsender/Alert_on_Unexpected_Content_Types.js" \
  \
  && wget -P /zap/plugin "$ZAP_PLUGINS/openapi-v13/openapi-alpha-13.zap" \
  \
  && wget -P /zap \
       "$ZAP_SOURCE/docker/zap_common.py" \
       "$ZAP_SOURCE/docker/zap-api-scan.py" \
  \
  && echo '#!/bin/bash'       > /zap/zap-x.sh \
  && echo '/zap/zap.sh "$@"' >> /zap/zap-x.sh \
  \
  && chmod a+x /zap/zap-api-scan.py /zap/zap-x.sh

USER zap

The owasp/zap2docker-bare docker image is recommended for use in CI environments, but it's missing a few useful scripts, such as ZAP API Scan and the OpenAPI plugin. This docker file includes both.