Docker Best Practices

Chapter 2 · Practice 3 of 5

Scan images for known vulnerabilities

From Image size and security

Why it matters

Your image inherits every CVE in its base and its packages. A scanner compares the packages in the image against vulnerability databases and tells you what to upgrade.

Free options:

  • Trivy and Grype, both listed in the OWASP Docker Security Cheat Sheet.
  • Docker Scout, built into Docker Desktop and the CLI.

When to scan:

  1. Locally, before you push.
  2. In CI, on every build.

Focus on critical and high issues that have a fix available. Most are solved by rebuilding on a newer base or upgrading one package, so the fix is usually quicker than it looks.

Example

Shell
docker scout cves my-app:1.4.0
# or
trivy image --severity CRITICAL,HIGH my-app:1.4.0