thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Container Image Scanning

Scanning container images for vulnerable OS packages and libraries, misconfigurations, secrets and malware before and after deployment.

Definition

Scanners such as Trivy, Grype, Clair and cloud registry scanners compare image contents with vulnerability databases. Scanning should happen in CI, at the registry and continuously for running images because new CVEs are published after build.

Example

The registry rescans stored images nightly and alerts when a new critical CVE affects a deployed image.

Exam tip

Scan at build and continuously; an image clean at build time can become vulnerable later.

Related terms