Scanning Images for Vulnerabilities

Scan images with tools like docker scout or trivy to find known security vulnerabilities in their packages.

Syntaxdocker scout cves IMAGE:TAG

Images bundle many libraries, and some may contain known security flaws. Image scanning checks an image's contents against vulnerability databases.

Scanning tools

  • Docker Scout — built into Docker, run with docker scout cves.
  • Trivy — a popular open-source scanner.
  • Grype — another widely used scanner.

Reducing risk

  • Use small, minimal base images with fewer packages.
  • Rebuild regularly to pick up patched dependencies.
  • Scan automatically in your CI pipeline and fail on critical issues.

Example

Example · bash
# Scan a local image with Docker Scout
docker scout cves myapp:1.0

# Scan with Trivy (runs as a container)
docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image myapp:1.0

When to use it

  • A CI pipeline runs trivy on every built image and fails the build if any CRITICAL vulnerabilities are found before the image is pushed.
  • A security team schedules weekly scans of all production images in their registry to catch newly disclosed CVEs.
  • A developer runs docker scout on a base image before choosing it, to compare the vulnerability count of node:20 vs node:20-alpine.

More examples

Scan image with Trivy

Runs Trivy to list all known CVEs in the image and returns exit code 1 on critical findings for CI gating.

Example · bash
# Install trivy (Debian/Ubuntu)
apt-get install -y trivy

# Scan a local image
trivy image myapp:1.0

# Fail CI if CRITICAL vulns exist
trivy image --exit-code 1 --severity CRITICAL myapp:1.0

Scan with Docker Scout

Uses the built-in Docker Scout CLI to show CVEs and compare vulnerability counts between two image versions.

Example · bash
docker scout cves myapp:1.0

# Compare two images
docker scout compare myapp:1.0 myapp:1.1

Pin base image to reduce attack surface

Replaces the mutable Alpine tag with an immutable digest so the base image cannot silently change between builds.

Example · dockerfile
# Before: mutable tag, unknown contents
FROM node:20-alpine

# After: immutable digest, auditable
FROM node:20-alpine@sha256:a1b2c3d4e5f6...

COPY . .
RUN npm ci --omit=dev

Related

docker securitydocker base images

Discussion

  • Be the first to comment on this lesson.