I wrote sieve last week to replace trivy in my homelab. A few people asked how to actually get it going, so this is the short version. The long version is docs/SETUP.md in the repo.

One thing I've done differently this time: the guide is tested. A GitHub job pulls the commands out of SETUP.md and runs them on a brand new Ubuntu machine every week. If a step breaks, the job goes red before you find out the hard way.

sieve's setup steps running on a fresh GitHub runner: install with pipx, scan the host, scan a running Debian 12 container

That's a real run from today. Funny thing is, a fresh GitHub runner isn't clean: 32,445 findings, 9 of them actively exploited (all kernel tool packages with no fix yet), 31 fixable.

Install

You need Linux and Python 3.10 or newer. No database, no server, no API key.

pipx install git+https://github.com/casareanderson/sieve sieve --version

If it says command not found, run pipx ensurepath and open a new terminal.

Scan the box you're on 

sieve host --limit 10

First run is the slow one, it downloads the CISA known-exploited list and the EPSS scores and asks OSV.dev about every package. After that it's cached.

Read it top down. A ⚠ in the KEV column means someone's exploiting it right now. A massive number with "0 fixable" is normal on a patched box, most of it is "affected, no fix released yet".

The exit code is the useful bit for cron: 0 nothing known-exploited, 1 at least one KEV finding, 2 part of the scan failed.

Scan your containers

This needs root, because container filesystems live under /proc/<pid>/root:

sudo "$(command -v sieve)" containers

Or run the collector on another Docker host with nothing installed there except python3:

sieve collector | ssh root@dockerhost python3 - > packages.tgz sieve containers --from-tar packages.tgz

Put it on a timer

The line I'd actually use, only shouts about things you can fix:

0 7 * * 1 sieve all --fixable-only --min-severity high

There's also a Docker image and a GitHub Action, both in the guide.

What CI can't prove

Not much for this one. The weekly run covers install, host scan, JSON output, a real container scan and the Docker image. It can't tell you how your own distro feeds behave: Fedora, RHEL and Arch get their Python and container language packages checked, not the OS ones.

Full guide: github.com/casareanderson/sieve/blob/main/docs/SETUP.md

Anyone else running a scanner on a timer at home? What do you do with the "no fix yet" pile?

🤖 Drafted with AI assistance from my own homelab notes, logs and repos, then reviewed and edited before publishing.