Docker Image Scanning

Image scanning detects vulnerabilities in Docker images.

Docker Scout

# Scan an image
docker scout cves myapp:latest

# Scan with details
docker scout cves --only-severity critical,high myapp:latest

# Export the results
docker scout cves --format json myapp:latest > report.json

Trivy

# Install Trivy
brew install trivy

# Scan an image
trivy image myapp:latest

# Scan with output
trivy image --format json myapp:latest > report.json

# Scan critical only
trivy image --severity CRITICAL myapp:latest

Use Case: Security Scan

# Scan before pushing
docker scout cves myapp:latest

# Fix the vulnerability
# Update the base image
FROM node:18.17-alpine  # Use the latest version

# Rescan
docker scout cves myapp:latest

CI/CD Integration

# .github/workflows/security.yml
name: Security Scan
on: push

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3

      - name: Build image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: myapp:${{ github.sha }}
          format: 'table'
          exit-code: '1'
          severity: 'CRITICAL,HIGH'

Everyday Use Case

Case: A developer needs to scan the image before deploying.

# Scan the image
docker scout cves myapp:latest

# If there are vulnerabilities, fix them
docker build -t myapp:fixed .
docker scout cves myapp:fixed

Best Practices

1. Scan before pushing: Avoid images with vulnerabilities
2. Use a minimal base image: Reduce the attack surface
3. Update regularly: Patch vulnerabilities
4. Integrate into CI/CD: Automatic scanning in the pipeline

Conclusion

Image scanning is important for security. Use Docker Scout or Trivy to detect vulnerabilities before deploying.