Container Scanning
ELI5 — The Vibe Check
Container Scanning checks your Docker images for known vulnerabilities in OS packages, libraries, and misconfigurations. Your app might be secure, but if the base image has 200 CVEs, you're serving code on a rotten foundation. Scan before you ship.
Real Talk
Container scanning analyzes container images for OS-level vulnerabilities, application dependencies, malware, secrets, and misconfiguration. Tools like Trivy, Grype, Snyk Container, and Clair scan image layers against CVE databases and CIS benchmarks.
Show Me The Code
# Scan with Trivy
trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest
When You'll Hear This
"Trivy found 47 CVEs in our base image — switching to Alpine cut it to 3." / "Container scanning runs on every image push to our registry."
Related Terms
Distroless Image
Distroless images are Docker images with NOTHING in them except your app. No shell, no package manager, no ls, no curl — nothing an attacker could use.
Image Signing
Image Signing is like putting a wax seal on your Docker images.
SBOM (SBOM)
An SBOM (Software Bill of Materials) is a complete ingredient list for your software — every library, framework, and dependency with their exact versions.
Supply Chain Security
Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.