What is container image scanning?
⚡
Quick Answer
Image scanning inspects container images for known vulnerabilities in OS packages and app dependencies (and often misconfig/secrets), using tools like Trivy, Grype, or Clair, ideally in CI and in the registry.
Detailed Answer
Scan at build (fail the pipeline on critical CVEs), on push (registry scanning), and continuously (new CVEs appear for images already deployed). Reduce findings at the source with minimal/distroless base images and regular rebuilds. Pair scanning with image signing (cosign) and admission policies that only allow scanned, signed images.
💡
Interview Tip
Note that new CVEs appear over time, so scan in CI, in the registry, and continuously — not just once.
image-scanningtrivycontainers