DevSecOps Practice Hub

Container Security

Scan container images for vulnerable packages and misconfiguration, and harden how images are built.

BeginnerContainer Image ScanningContainerSupply Chain

Where it fits in the lifecycle

  1. Plan
  2. Code
  3. Build
  4. Test
  5. Release
  6. Deploy
  7. Operate
  8. Monitor
  • Build Dependency scanning, image scanning, SBOM generation and signing.
  • Deploy Policy enforcement, admission control and infrastructure security.

Overview

Container images bundle an OS userland plus application dependencies. Image scanning enumerates those layers and reports known vulnerabilities; image hardening reduces what is there to exploit in the first place.

Why it matters

A base image chosen once can propagate vulnerable packages to every service. Scanning at build time keeps the blast radius visible and small.

How it works

  1. 01The scanner reads the image manifest and extracts package databases per layer.
  2. 02Packages are matched against distribution and language advisories.
  3. 03Dockerfile checks flag root users, missing pinning and secrets in layers.
  4. 04Registry-side scanning re-evaluates images as new advisories are published.

Common tools

TrivyGrypeClairDocker ScoutDockerPodmanKubernetesOpenShift

Implementation examples

yamlScan an image in CI
container_scan:  stage: security  script:    - trivy image --exit-code 1 --severity CRITICAL --ignore-unfixed $IMAGE_NAME
Runs after the build stage and before the image is promoted to a shared registry.
dockerfileMinimal, non-root Dockerfile
FROM python:3.12-slim AS baseRUN useradd --uid 10001 --create-home appWORKDIR /appCOPY --chown=app:app requirements.txt .RUN pip install --no-cache-dir -r requirements.txtCOPY --chown=app:app . .USER 10001CMD ["python", "-m", "app"]
A slim base and an explicit non-root UID remove two of the most common findings. Pin the base image by digest for reproducibility.

Best practices

  • Rebuild regularly so base-image fixes actually reach production.
  • Pin base images by digest and keep a small set of approved bases.
  • Scan in CI and continuously in the registry.

Common mistakes

  • Scanning only at build time and never rescanning stored images.
  • Building with secrets passed as build args, which persist in layer history.

Hands-on labs