Container images are one of the biggest attack surfaces in modern software. A single vulnerable package in your Docker image can compromise your entire application. Here's how to scan and secure your containers.

Why Container Scanning Matters

- 60% of images contain at least one critical vulnerability

Base images often have hundreds of outdated packages

Supply chain attacks increasingly target container registries

Compliance frameworks now require container SBOMs

Method 1: Scan a Docker Image

With VulnLedger CLI:

`bash

vulnledger scan docker://nginx:latest `

This generates an SBOM of the image and checks every package against OSV.dev.

Method 2: Scan During Build

Add scanning to your Dockerfile or CI pipeline:

`yaml

GitHub Actions

name: Build and scan

run: | docker build -t my-app . vulnledger scan docker://my-app `

Method 3: Web Dashboard

VulnLedger Cloud lets you scan container images directly from the web UI. Enter an image reference and get results in seconds.

Understanding Container Vulnerabilities

Container images contain multiple layers:

1. Base OS: Ubuntu, Alpine, Debian packages 2. System libraries: OpenSSL, glibc, etc. 3. Language packages: pip, npm, cargo packages 4. Application code: Your custom code

Each layer can have different vulnerabilities. A complete scan covers all layers.

Best Practices

1. Scan before deploying: Never push unscanned images to production 2. Use minimal base images: Alpine and distroless images have fewer vulnerabilities 3. Pin versions: Use specific tags, not latest 4. Automate scanning: Integrate into CI/CD 5. Monitor continuously: New CVEs are published daily

Remediation

When vulnerabilities are found:

1. Check for fixes: Most CVEs have patched versions 2. Update base images: Pull the latest version 3. Remove unused packages: Fewer packages = smaller attack surface 4. Use VEX documents: Document accepted risks for unfixable vulnerabilities

Conclusion

Container scanning is essential for modern DevOps. Make it part of your CI/CD pipeline and you'll catch vulnerabilities before they reach production.