Docker
/Intermediate
Image Scanning
Definition
The automated process of analyzing the contents of a Docker image to detect known Common Vulnerabilities and Exposures (CVEs), outdated libraries, or leaked passwords before the image is allowed to run in production.
Explain Like I'm New
An X-ray machine at the airport. Before the image is allowed onto the production server, the scanner checks its luggage for bombs (vulnerabilities). If it finds an outdated, easily-hackable version of Java, it blocks the image.
Real World Example
A company uses Trivy (an open-source scanner) in their CI/CD pipeline. A developer accidentally commits a Dockerfile using an incredibly old version of Ubuntu. When the code is pushed, Trivy scans the image, finds 40 'Critical' vulnerabilities, and automatically fails the build.
Common Use Cases
- •CI/CD pipelines
- •Vulnerability management
Interview Questions
basic
- Should Image Scanning happen manually once a month, or automatically on every single code push?
intermediate
- If an Image Scanner detects a 'CVE' in your image, what exactly did it find?