Scan Container Images for Vulnerabilities

This skill provides expertise in container image security scanning and vulnerability assessment, with deep knowledge of container security best practices, vulnerability databases (CVE, NVD), image scanning tools, and compliance frameworks, analyzing images for vulnerabilities, misconfigurations, and providing practical remediation guidance. Core scanning principles cover shifting security left (scanning images early in the pipeline before deployment), multi-layer analysis (examining base images, application dependencies, and configuration layers), continuous monitoring (regularly scanning registry and running container images), risk-based prioritization (focusing first on critical and high-severity vulnerabilities), supply chain security (verifying image provenance and dependency integrity), and compliance alignment (PCI DSS, SOC 2, etc).

Vulnerability scanning tool integration covers Trivy (Docker-based scanning filtered to HIGH/CRITICAL severity with JSON output, plus custom Rego policy scanning), Grype (Anchore's scanner with quality gates like --fail-on high --only-fixed), and Snyk (CLI container testing with a severity threshold and SARIF output for CI/CD). CI/CD pipeline integration covers a GitLab CI security-scan stage running Trivy against the built image with a GitLab-formatted report and allow_failure: false to block on findings, and a GitHub Actions workflow building the image, running the Trivy action with SARIF output, and uploading results via CodeQL's SARIF upload action for visibility in the Security tab.

Custom security policies use OPA Rego to enforce organizational rules - denying deployment on any critical vulnerability, requiring images come from an approved base-image prefix, requiring a security-scan-timestamp label, and requiring valid image signatures. Advanced scanning configurations cover multi-stage Dockerfile security analysis (building in a full base image, then copying only necessary artifacts into a minimal distroless final image running as a non-root user) and continuous registry-level scanning (a Python script iterating over all images in a registry, running Trivy against each tag, and aggregating results over time).

Use this skill when setting up or improving container image security scanning - tool selection, CI/CD gate integration, or custom policy enforcement with OPA. It is well suited to teams running containerized workloads that need vulnerability gates before deployment. It is not meant for non-containerized deployments, or for a one-off manual scan with no ongoing CI/CD integration or registry monitoring.

Input: the container image(s) to scan and the compliance/severity thresholds to enforce.

Output: scan results (JSON/SARIF), a CI/CD pipeline gate, and OPA policy rules for enforcement. Example Trivy CI/CD integration:

container_scanning:
  stage: security-scan
  script:
    - docker run --rm -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:latest image \
        --severity HIGH,CRITICAL --output gl-container-scanning-report.json $CI_APPLICATION_REPOSITORY
  allow_failure: false

Works with Trivy, Grype, and Snyk for scanning, GitLab CI and GitHub Actions for pipeline gates, and OPA/Rego for custom policy enforcement.

DevOps and security engineers setting up container image scanning gates in CI/CD, and platform teams enforcing image compliance policies (signing, approved base images, vulnerability thresholds).