Lesson 3.5: Scanning images for vulnerabilities
Every image carries an operating system's worth of packages from its base, and those packages have known vulnerabilities (CVEs). Scanners like Trivy list them with severity and the version that fixes them, so you can block dangerous images in the pipeline and patch by rebuilding. In the lab you scan the running API image, focus on critical and high findings, separate what a rebuild fixes from what has no fix yet, and compare with the new image built from the hardened Dockerfile on a current base.
16 min
You will learn to
- Explain what an image scanner checks
- Read a Trivy report
- Filter by severity
- Separate fixable from unfixed findings
- Patch by rebuilding on a current base
Key terms
- CVE
- Common Vulnerabilities and Exposures: a public ID for a known vulnerability.
- Severity / CVSS
- How serious a vulnerability is; CVSS gives a 0–10 score mapped to LOW, MEDIUM, HIGH, CRITICAL.
- Image scanner
- A tool that lists packages in an image and matches them against vulnerability databases.
- Fixed version
- The package version that resolves a vulnerability; empty when no fix exists yet.
- SBOM
- Software bill of materials: a list of all components in an image or application.
← Sigma rules · All lessons · How systems store passwords →