Scanning Images for Vulnerabilities

1. Scanning with Docker Scout

Command	Description	Example
docker scout cves	Scan image for CVEs and vulnerabilities	`docker scout cves myapp:latest`
docker scout cves --json	Output scan results in JSON format	`docker scout cves --json myapp:latest`
docker scout cves --severity high	Filter results by severity level	`docker scout cves --severity high myapp:latest`

Example: Scanning an Image for CVEs

docker scout cves myapp:latest

Note: Docker Scout is a free tool included with Docker Desktop and Docker Engine that helps identify vulnerabilities in container images.

Warning: Ensure you are scanning the correct image tag and that it's up to date with the latest security patches.

2. Viewing Vulnerability Recommendations

Recommendation	Description	Impact	Severity
Update Base Image	Upgrade to a newer version of the base image that includes patched vulnerabilities.	High	NEW
Scan with Trivy	Use Trivy to scan the image for vulnerabilities and generate a report.	Medium	DEPRECATED
Use Multi-Stage Builds	Implement multi-stage builds to reduce the attack surface by minimizing layers.	High	NEW

Example: Using Trivy to Scan Image

trivy image --severity HIGH,CRITICAL myapp:latest

Note: Trivy is a popular open-source vulnerability scanner for container images.

Warning: Ensure that your Docker image is scanned regularly to identify and address security issues.

3. Comparing Image Vulnerabilities

Tool	Scan Type	Output Format	Key Features
Docker Scout	`image scan`	JSON, HTML	Integrated with Docker Desktop, real-time vulnerability alerts
Trivy	`trivy image`	JSON, SARIF, Table	Open-source, supports multiple formats, can scan local images
Clair	`clairctl scan`	JSON, HTML	Open source, supports layered scanning, can integrate with registries
Snyk	`snyk container scan`	JSON, HTML	Cloud-based, integrates with CI/CD pipelines, supports image and code scanning
Aqua Security	`aqua scan`	JSON, HTML	Comprehensive security platform, supports image and runtime scanning

Comparison Summary

Docker Scout: Best for Docker-native workflows, easy integration with Docker Desktop.
Trivy: Ideal for open-source environments, supports a wide range of formats and can be used in CI/CD.
Clair: Good for organizations already using Clair or requiring registry integration.
Snyk: Strong for enterprise environments with CI/CD integration and cloud-based scanning.
Aqua Security: Comprehensive security solution, suitable for organizations requiring runtime scanning.

4. Setting Severity Threshold

Option	Values	Description
--severity	`LOW`, `MEDIUM`, `HIGH`, `CRITICAL`	Set the minimum severity level to report vulnerabilities

Example: Scan with Severity Threshold

docker scan --severity HIGH my-app:latest

Note: The default severity threshold is LOW. Setting it to HIGH or CRITICAL filters out less severe issues.

5. Generating SBOM

Example: Generate SBOM with Docker CLI

docker scan --format spdx my-image:latest

Option	Values	Description
--format	`spdx`, `json`, `text`	Output format for SBOM (SPDX, JSON, or plain text)
--output	file path	Write SBOM to a file instead of stdout

Note: Docker Scan uses the syft tool under the hood to generate SBOMs.

Warning: The docker scan command requires Docker Desktop or Docker Engine v24.0+.

SBOM Generation Workflow

Run docker scan --format spdx <image>
Review or save output to a file
Use SBOM for compliance, audit, or vulnerability tracking

6. Using Trivy for Scanning

Option	Values	Description
trivy image <image-name>	`trivy image nginx:latest`	Scan a Docker image for vulnerabilities
trivy image --severity HIGH,CRITICAL <image-name>	`trivy image --severity HIGH,CRITICAL nginx:latest`	Scan with severity filter to show only HIGH and CRITICAL vulnerabilities
trivy image --format json <image-name>	`trivy image --format json nginx:latest`	Output scan results in JSON format for integration with tools
trivy image --output results.json <image-name>	`trivy image --output results.json nginx:latest`	Save scan results to a file
trivy image --ignore-unfixed <image-name>	`trivy image --ignore-unfixed nginx:latest`	Ignore unfixed vulnerabilities in the scan results

Example: Scan an image for vulnerabilities

trivy image nginx:latest

Example: Scan with severity filter

trivy image --severity HIGH,CRITICAL nginx:latest

Example: Save scan results to a file

trivy image --output results.json nginx:latest

Note: Trivy is a fast and comprehensive vulnerability scanner for container images, built-in support for Kubernetes and cloud-native environments.

7. Implementing CI/CD Security Checks

Example: Integrating Docker Scout in GitHub Actions

name: Scan Docker Image
on:
  push:
    branches: [ main ]
jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4
      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3
      - name: Build image
        run: |
          docker build -t myapp .
      - name: Scan with Docker Scout
        uses: docker/scout-action@v1
        with:
          image: myapp
          format: table

Step	Description	Command/Action
1. Setup	Initialize Docker Scout in CI environment	`uses: docker/scout-action@v1`
2. Scan Image	Scan a built Docker image for vulnerabilities	`with: image: myapp`
3. Format Output	Display results in table format	`format: table`

Note: Docker Scout integrates with CI/CD platforms to automate image scanning as part of your build pipeline.

Warning: Ensure Docker Scout is configured with appropriate credentials to access your image registry.

Security Check Workflow

Build Docker image during CI process
Run Docker Scout to scan for vulnerabilities
Fail pipeline if critical issues are found

8. Managing Scan Results

Example: Viewing scan results in JSON format

docker scan --format json my-app:latest

Field	Description	Example Value
Vulnerabilities	Number of vulnerabilities found	`5`
Critical	Count of critical vulnerabilities	`2`
High	Count of high severity vulnerabilities	`1`
Medium	Count of medium severity vulnerabilities	`2`
Low	Count of low severity vulnerabilities	`0`
Scan Date	Date when the scan was performed	`2026-04-05T10:30:00Z`

Note: Docker scans are performed using the docker scan command, which integrates with Docker Hub's vulnerability database.

Warning: Vulnerability scanning is an optional feature and requires a Docker Hub account with access to the vulnerability database.

Managing Scan Results Summary

Use docker scan --format json to get structured output
Scan results include severity levels: Critical, High, Medium, Low
Results are updated periodically based on Docker Hub's database
Scan results can be filtered or exported for further analysis

9. Fixing Common Vulnerabilities

Vulnerability Type	Common Fix	Notes
Outdated Base Images	`FROM alpine:latest`	Use the latest stable base image to reduce known vulnerabilities
Unnecessary Packages	`RUN apk del <package>`	Remove packages not needed at runtime to reduce attack surface
Exposed Credentials	`ENV SECRET_KEY=`	Never store secrets in Dockerfile or image layers
High-Severity CVEs	`RUN apk update && apk upgrade`	Update packages to versions with fixes for CVEs

Example: Updating Alpine Image to Fix CVEs

FROM alpine:latest
RUN apk update && apk upgrade
RUN apk add --no-cache curl

Note: Always scan images after applying fixes to verify vulnerabilities are resolved.

Warning: Avoid using latest in production; pin to specific versions for stability.

10. Using Docker Bench for Security

Example: Running Docker Bench for Security

# Run Docker Bench for Security
docker run --rm -i --name docker-bench-security \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /etc:/etc:ro \
  -v /proc:/proc:ro \
  -v /sys:/sys:ro \
  -v /usr/bin/docker:/usr/bin/docker:ro \
  docker/bench-security

Check ID	Description	Severity	Status
Docker Bench for Security	Security best practices audit tool for Docker containers and hosts	High	Pass/Fail

Key Checks Performed

Docker daemon configuration audit
Container image security checks
Host system security settings
Network and filesystem configurations

Note: Docker Bench for Security is an open-source tool maintained by the Docker team. It helps identify misconfigurations and security vulnerabilities in Docker environments.

11. Auditing Docker Configurations

Configuration	Description	Security Impact	Recommended Setting
user	Specifies the user to run the container as	Running as root increases risk of privilege escalation	Non-root user (e.g., `node`)
read-only root filesystem	Mounts the root filesystem as read-only	Prevents malicious code from writing to disk	`--read-only`
disable privileged mode	Disables the ability to gain host-level privileges	Reduces attack surface for container escapes	`--privileged=false`
limit memory usage	Prevents containers from consuming all host memory	Avoids DoS attacks on the host system	`--memory=512m`
disable host networking	Disables direct access to the host network stack	Reduces exposure to network-based attacks	`--network=none`

Example: Secure Dockerfile Configuration

FROM node:20-alpine
RUN adduser -D -s /bin/sh appuser
USER appuser
WORKDIR /app
COPY package*.json ./
RUN npm ci --only=production
COPY . .
EXPOSE 3000
CMD ["node", "server.js"]

Note: Use docker inspect to verify container settings post-creation.

Warning: Avoid using USER root in Dockerfiles unless absolutely necessary.

12. Implementing Image Signing

Component	Description	Notes
docker trust	Command-line tool for signing and verifying Docker images	Part of Docker Content Trust (DCT)
notary	Server component for managing image signatures	Used by Docker CLI to store and retrieve signatures
signing key	Private key used to sign image manifests	Must be securely stored and managed

Example: Signing an Image

docker trust sign myregistry.com/myapp:latest

Example: Verifying an Image

docker trust inspect myregistry.com/myapp:latest

Note: Image signing requires Docker Content Trust to be enabled. Set DOCKER_CONTENT_TRUST=1 in your environment.

Warning: If the signing key is lost, it will be impossible to sign new versions of the image or verify existing signed images.