Container Scanning

Vulnerability scanners compare the packages in an image, filesystem or repo against CVE databases, and can also check IaC for misconfiguration and find embedded secrets. This sheet covers Trivy (all-rounder), Grype and Syft (scanner plus SBOM generator). Used with Docker, Dockerfile and Kubernetes; for secrets in Git see Secret Scanning.

Documentation: Trivy · Grype · Syft

Install #

# Trivy (Debian/Ubuntu apt repo is documented at trivy.dev), or:
brew install trivy grype syft
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy image <IMAGE>

Trivy #

Ignore Findings #

.trivyignore (one CVE per line, optional expiry and comment):

# not reachable, upstream fix pending
CVE-2024-12345 exp:2026-12-31

Rich ignores (paths, purls) go in trivy.yaml / .trivyignore.yaml; see the Trivy filtering docs.

CI (GitHub Actions) #

- uses: aquasecurity/trivy-action@<TAG>
  with:
    image-ref: ghcr.io/<OWNER>/<IMAGE>:${{ github.sha }}
    severity: CRITICAL,HIGH
    ignore-unfixed: true
    exit-code: "1"

Pin the action to a tag or commit SHA. Scan the freshly built image before pushing the latest tag.

Grype and Syft #

.grype.yaml ignore rules:

ignore:
  - vulnerability: CVE-2024-12345
  - package:
      name: busybox
      type: apk

Reducing Findings #

• Pick small bases (alpine, debian-slim, distroless) and multi-stage builds (Dockerfile).
• Pin by digest (image: nginx@sha256:...) and let Renovate raise update PRs.
• Run containers as non-root, read-only filesystem, drop capabilities:

services:
  app:
    image: ghcr.io/example/app:1.2.3
    user: "1000:1000"
    read_only: true
    cap_drop: [ALL]
    security_opt: ["no-new-privileges:true"]
    tmpfs: [/tmp]

See Docker-Compose.

• Rescan on a schedule, because new CVEs appear against old images.

Troubleshooting #