Skip to main content

Container Scanning

Path: /code/containers · Sidebar: Testing → Code Security → Containers

Container scanning analyses image layers for vulnerable OS packages and bundled libraries, so you catch CVEs that live in the base image - not just your code.

What it finds​

  • OS package CVEs (Alpine/Debian/Ubuntu/RHEL, etc.).
  • Application library CVEs baked into the image.
  • Severity, fixed-version, and the layer that introduced the issue.

Run a container scan​

  1. Reference the image (from your registry, or built in CI/CD).
  2. apPosture inspects each layer and resolves package versions to advisories.
  3. Findings roll into Vulnerabilities, enriched with EPSS/KEV.

Reading a container finding​

  • Image + tag, package, current vs. fixed version.
  • Layer attribution - which instruction added the vulnerable package, so you know whether to rebuild from a newer base image or update a dependency.
Fix at the base

Many container CVEs come from an outdated base image. Bumping the base often resolves dozens of findings at once - check layer attribution before patching packages individually.

Last updated on