Quick Notes96 words
Automating container scanning — quick notes
Container scanning — quick notes
| Target | Finds |
|---|---|
| Base image / OS packages | Inherited CVEs |
| Application code inside | Vulnerable patterns (CodeQL) |
- Scan before push → keep vulnerable images out of the registry.
- Scan in the registry continuously → catch CVEs disclosed after build.
- CodeQL in a container requires advanced setup — default setup cannot express it.
- Most base-image findings are fixed by rebuilding on a patched base.
Trap: scanning only at build time. The image ages even when your code does not.