Image Scanning

Overview

Image scanning identifies vulnerabilities and misconfigurations in container images before runtime deployment.

Scan Targets

• Operating system packages
• Language dependencies
• Known CVEs
• Configuration weaknesses

flowchart LR
    A[Build Image] --> B[Security Scan]
    B --> C{Critical Issues?}
    C -->|Yes| D[Block Release]
    C -->|No| E[Publish Image]

Practical Example

trivy image company/payment-service:1.8.3

Production Example

Mature pipelines enforce policy gates that fail builds on critical vulnerabilities unless approved exceptions exist.

Common Pitfalls

• Scanning only after deployment
• Ignoring fix availability and patch prioritization
• No baseline for acceptable risk

Key Takeaways

• Image scanning should be integrated into CI pipelines.
• Policy gates improve consistency and risk control.
• Vulnerability management requires prioritization workflows.