The current job definition is only using dind because we have 2 linked containers: https://gitlab.com/gitlab-org/gitlab-ee/blob/master/lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml I don't see any reason why we can't use a [gitlab-runner service](https://docs.gitlab.com/ee/ci/docker/using_docker_images.html#what-is-a-service): ```yaml - docker run -d --name db arminc/clair-db:latest - docker run -p 6060:6060 --link db:postgres -d --name clair --restart on-failure arminc/clair-local-scan:v2.0.6 ``` The rest of the script can (and should) be in a `Dockerfile` to create a `container_scanning` image. **Update:** unable to use `arminc/clair-db:latest` and `arminc/clair-local-scan:v2.0.6` as services because current version of GitLab Runner does not link service containers to each other, [details below](https://gitlab.com/gitlab-org/gitlab-ee/issues/10662#note_154387848). see https://gitlab.com/groups/gitlab-org/-/epics/971 for previous comments