ci: support isolated TCP Docker scanners

scripts/generate_container_sbom.sh

@@ -5,6 +5,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 TARGET_IMAGE="${1:-geointel-ci:local}"
 OUTPUT="${2:-artifacts/geointel-sbom.spdx.json}"
 SYFT_IMAGE="anchore/syft:v1.44.0@sha256:86fde6445b483d902fe011dd9f68c4987dd94e07da1e9edc004e3c2422650de6"
+SCANNER_ENGINE_ARGS=()
 
 case "$OUTPUT" in
   /*|*..*)
@@ -13,17 +14,38 @@ case "$OUTPUT" in
     ;;
 esac
 
+configure_scanner_engine() {
+  local docker_host="${DOCKER_HOST:-}"
+  if [[ "$docker_host" == tcp://* ]]; then
+    local port="${docker_host##*:}"
+    if ! [[ "$port" =~ ^[0-9]+$ ]] || (( port < 1 || port > 65535 )); then
+      echo "Unsupported TCP Docker host for nested scanner: $docker_host" >&2
+      exit 1
+    fi
+    SCANNER_ENGINE_ARGS=(
+      --add-host host.docker.internal:host-gateway
+      -e "DOCKER_HOST=tcp://host.docker.internal:${port}"
+    )
+  elif [[ -z "$docker_host" || "$docker_host" == unix:///var/run/docker.sock ]]; then
+    SCANNER_ENGINE_ARGS=(-v /var/run/docker.sock:/var/run/docker.sock)
+  else
+    echo "Unsupported Docker host for nested scanner: $docker_host" >&2
+    exit 1
+  fi
+}
+
 docker image inspect "$TARGET_IMAGE" >/dev/null
 mkdir -p "$ROOT/$(dirname "$OUTPUT")"
+configure_scanner_engine
 
-# Gitea/act executes jobs inside a container while Docker commands target the
-# host daemon. Host-path binds to $ROOT therefore do not point at the checkout.
-# Stream the SPDX document over stdout instead; only the Docker socket crosses
-# the nested-runner boundary.
+# Native/local runs use the normal Unix socket. Gitea jobs can target the
+# isolated TCP DinD daemon; scanner containers then reach that same daemon via
+# Docker's host-gateway alias instead of receiving the Unraid host socket.
 docker run --rm \
-  -v /var/run/docker.sock:/var/run/docker.sock \
+  "${SCANNER_ENGINE_ARGS[@]}" \
   "$SYFT_IMAGE" \
   "$TARGET_IMAGE" \
+  --from docker \
   -o spdx-json > "$ROOT/$OUTPUT"
 
 test -s "$ROOT/$OUTPUT"