What is image scanning and what does it actually check?

Image scanning tools (Trivy, Grype, Docker Scout, Snyk) enumerate every installed OS package and language-level dependency in an image's layers, building an effective Software Bill of Materials, then cross-reference that list against vulnerability databases (NVD, OSV, vendor advisories) to flag known CVEs by severity. It does not detect zero-day or custom application-logic vulnerabilities — only known, cataloged issues in the packages you've included.