Scanning image content for vulnerabilities

Container images can be securely stored in registries, and we can track their provenance and ownership by reviewing their digests and signatures. It would be great if we could trust all the files included in the image layers. There are many solutions that can check whether any of the files included inside the image layers are somehow vulnerable to any reported issues or exploits that can affect your application’s integrity. However, this requires new tools and effort.

Image scanning can be implemented in either your local development environment or the remote registries where images are eventually stored and shared. Most content scanners use well-known public and community-supported databases of known vulnerabilities and exploits. These will give us a list of Common Vulnerabilities and Exposures (CVEs) to compare against our content. Each binary or library in this list is identified by its digest, and it is easy to find out whether...