Finding known problems.
WHAT A SCANNER DOES
Compares the packages in an image against databases of known vulnerabilities.
WHAT IT FINDS
Operating system packages with published issues Language dependencies with known problems
WHAT IT DOES NOT FIND
Flaws in your own code Misconfiguration Anything not yet published
WHEN TO SCAN
On every build Periodically on images already running
WHY THE SECOND
Vulnerabilities are announced after the build.
WHAT TO DO WITH THE OUTPUT
Triage it.
WHY NOT FIX EVERYTHING
Most findings are in components never invoked, and treating all as urgent means none get attention.
WHAT TO PRIORITISE
Severe issues Ones with known exploitation Ones in components your application actually uses
WHAT REDUCES FINDINGS DRAMATICALLY
A smaller base image.
WHY
Fewer packages means fewer vulnerabilities.
WHAT TO DO ABOUT FINDINGS WITH NO FIX
Record the decision, with a review date.
WHAT TO FAIL A BUILD ON
A policy you have agreed, rather than every finding.
WHY
A pipeline that always fails is ignored.
WHAT TO TRACK
Time from a fix being available to it being deployed.
WHAT TO AUTOMATE
Rebuilding when base images update.
