Container Image Scanning.

The practice of analyzing OCI/Docker images for known vulnerabilities, secrets, malware, and policy violations before they are deployed to a container runtime. It belongs to the Defense & Operations category of cybersecurity.

The practice of analyzing OCI/Docker images for known vulnerabilities, secrets, malware, and policy violations before they are deployed to a container runtime.

Container image scanning inspects every layer of an OCI image — including the base OS, language packages, embedded binaries, and metadata — to identify known CVEs, embedded credentials, malware signatures, and non-compliant configurations. Tooling falls into two families: open-source scanners (Trivy by Aqua Security, Grype by Anchore, Clair, and Docker Scout) and commercial CNAPPs (Snyk Container, Prisma Cloud, Wiz, Sysdig Secure). Scans are typically run at three points: developer workstation, CI pipeline (failing builds on policy breach), and registry admission. Modern programs also generate signed SBOMs and feed them into supply-chain attestation systems such as Sigstore and SLSA to ensure provenance and reproducibility.

Defences for Container Image Scanning typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: image scanning, container vulnerability scanning.