Container Image Scanning
Image scanning detects known vulnerabilities in container images (OS packages, language dependencies, configuration), blocking risk before deployment.
Purpose
Automatically detect image vulnerabilities in CI/CD, preventing deployment of insecure images.
Mechanism
Scans packages and dependencies across image layers, matching against CVE databases (NVD/OSV). Scanners: Trivy/Grype/Snyk. CI gates: fail when severe vulnerabilities exceed thresholds. SBOM (software bill of materials) tracks dependencies.
Use cases
- Vulnerability management
- CI gating
- Supply chain security
Related terms
Container Image Registry
An image registry stores and distributes container images, supporting version tags, layered caching, and access control. GLOSSARY
CVE
CVE (Common Vulnerabilities and Exposures) is a system that assigns unique identifiers (CVE-YYYY-NNNN) to publicly disclosed security vulnerabilities, maintained by MITRE. GLOSSARY