Introducing Container Image Scanning

Container images are a popular way to package and deploy applications. These are the deployable artifacts in modern cloud native world. However, they often contain vulnerabilities and malicious packages. Conventional container image scanning tools focus on vulnerability (CVE) identification for container images. However, malicious or compromised packages do not have CVEs. To protect against the risk of vulnerabilities and malicious packages, deployable container images must be evaluated for security risks. vet⁠(opens in new tab) now supports scanning container images using --image flag.

Scanning Local Images

Container images available in local docker server catalog can be scanned using the following command:

vet scan --image redis:latest

Scanning Remote Images

vet will pull the image data if the container image is not available in local docker server catalog.

vet scan --image redis:latest

Scanning Local Tarballs

Exported container images can be scanned using the following command:

vet scan --image /path/to/image.tar

This tarball can be created using docker save command. This is useful when you want to scan a container image that is not available in local docker server catalog.

docker save redis:latest -o image.tar

Malicious Package Scanning

Container scanning can be combined with malware detection using the --malware flag. It also supports various reporting formats including --report-cdx and --report-json for generating standardized output.

vet scan --image redis:latest --malware

vet scan --image redis:latest --report-cdx=report.cdx.json

Policy Driven Container Scanning

vet is designed as policy first. It uses a Common Expression Language⁠(opens in new tab) based policy engine to allow flexible policies. For example, to prevent containers with malware or critical vulnerabilities from getting deployed, you can run vet with the following policy:

vet scan --image redis:latest --malware --filter 'vulns.critical.exists(p, true)' --filter-fail

Note: vet will always fail when a malicious package is detected.

Other scanning options

For more details on how to use vet with container scanning, please refer to the documentation⁠(opens in new tab).

Demo

Bugs and Feedback

Found a bug or have suggestions? We’d love to hear from you! Please open an issue in our vet GitHub repository⁠(opens in new tab). For discussions about vet and other SafeDep tools, join our friendly developer community on Discord⁠(opens in new tab). We’re always excited to connect with fellow developers and hear your thoughts!