intermediateContainer Security: Non-Root, Secrets, Image Scanning & Distroless
What is image scanning and what does it actually check?
Image scanning tools (Trivy, Grype, Docker Scout, Snyk) enumerate every installed OS package and language-level dependency in an image's layers, building an effective Software Bill of Materials, then cross-reference that list against vulnerability databases (NVD, OSV, vendor advisories) to flag known CVEs by severity. It does not detect zero-day or custom application-logic vulnerabilities — only known, cataloged issues in the packages you've included.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response