Cloud Security Container

Container Image Scanning and Vulnerability Management

January 11, 2026

Container image scanning identifies vulnerabilities in base images, application dependencies, and configurations before deployment. Integrating scanning into CI/CD pipelines prevents vulnerable containers from reaching production.

Trivy Scanning

# Scan container image
trivy image --severity HIGH,CRITICAL myapp:latest

# Scan with SBOM output
trivy image --format spdx-json -o sbom.json myapp:latest

# CI/CD integration
trivy image --exit-code 1 --severity CRITICAL myapp:latest

GitHub Actions

- name: Scan image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: myapp:${{ github.sha }}
    severity: CRITICAL,HIGH
    exit-code: 1

ECR Scanning

resource "aws_ecr_repository" "app" {
  name = "app"
  image_scanning_configuration {
    scan_on_push = true
  }
}

Implement scanning at build time and continuously monitor running containers for newly discovered vulnerabilities.

Related Posts: