How do you cut down the vulnerability count Grype reports on a container image?
⚡
Quick Answer
Most findings come from the base image and OS packages, not your code.
Detailed Answer
Most findings come from the base image and OS packages, not your code. Switch to a minimal or distroless base, use multi-stage builds so build tools never reach the final layer, keep the base pinned-but-updated, and remove unused packages. Distinguish fixable from unfixable — gate hard on fixable Criticals, and track unfixable ones with an ignore rule and an expiry rather than blocking forever on something with no patch available.
Code Example
# Deep-dive: Grype # scanning images, directories and SBOMs, pairing with Syft for SBOM generation, the vulnerability database refresh, --fail-on severity gating, .grype.yaml ignore rules, and comparing results against Trivy # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
💡
Interview Tip
This is where depth shows — be concrete about Grype, not generic about "security".
grypedevsecopsdeep-dive