What you are running.
WHAT THE RISKS ARE
Vulnerabilities in the base image Vulnerabilities in your dependencies Malicious images from untrusted sources Secrets embedded in layers Running as root
WHAT TO DO ABOUT BASE IMAGES
Use official ones, pinned to a version, and rebuild regularly.
WHY REBUILD REGULARLY
Fixes arrive in the base, and an image built once never receives them.
WHAT SCANNING PROVIDES
A list of known vulnerabilities in the image.
WHEN TO SCAN
On every build, and periodically on images already deployed.
WHY PERIODICALLY
Vulnerabilities are discovered after the build.
WHAT TO DO WITH RESULTS
Fix what is reachable and severe; record decisions about the rest.
WHY NOT FIX EVERYTHING
Many reported issues are in components your application never invokes.
WHAT TO NEVER DO
Ignore the scan entirely Treat every finding as equally urgent
WHAT TO RUN AS
A non-root user, specified in the image.
WHY
A compromise inside the container then has fewer options.
WHAT TO DROP
Capabilities the process does not need.
WHAT TO SET
A read-only filesystem, where the application permits.
WHAT TO VERIFY
Image signatures, where the publisher provides them.
WHAT TO MAINTAIN
A record of what each image contains.
