Container Scanning
ELI5 — The Vibe Check
Container Scanning checks your Docker images for known vulnerabilities in OS packages, libraries, and misconfigurations. Your app might be secure, but if the base image has 200 CVEs, you're serving code on a rotten foundation. Scan before you ship.
Real Talk
Container scanning analyzes container images for OS-level vulnerabilities, application dependencies, malware, secrets, and misconfiguration. Tools like Trivy, Grype, Snyk Container, and Clair scan image layers against CVE databases and CIS benchmarks.
Show Me The Code
# Scan with Trivy
trivy image --severity HIGH,CRITICAL --exit-code 1 myapp:latest
When You'll Hear This
"Trivy found 47 CVEs in our base image — switching to Alpine cut it to 3." / "Container scanning runs on every image push to our registry."
Related Terms
Distroless Image
Distroless images are Docker images with NOTHING in them except your app. No shell, no package manager, no ls, no curl — nothing an attacker could use.
Image Signing
Image Signing is like putting a wax seal on your Docker images.
SBOM
An SBOM is a complete ingredient list for your software — every library, every dependency, every version. Like food nutrition labels but for code.
Supply Chain Security
Supply Chain Security protects the entire path from code to production — dependencies, build systems, registries, everything.