---
title: "Introducing Container Image Scanning"
description: "Introducing Container Image Scanning, a new feature in vet to identify vulnerabilities and malicious packages in container images."
url: "https://safedep.io/blog/introducing-container-scanning"
author: "Kunal Singh"
published: "2025-06-03"
---

# Introducing Container Image Scanning

Container images are a popular way to package and deploy applications. These are the deployable artifacts in modern cloud native world. However, they often contain vulnerabilities and malicious packages. Conventional container image scanning tools focus on vulnerability (CVE) identification for container images. However, malicious or compromised packages do not have CVEs. To protect against the risk of vulnerabilities and malicious packages, deployable container images must be evaluated for security risks. [vet](https://github.com/safedep/vet) now supports scanning container images using `--image` flag.

### Scanning Local Images

Container images available in local docker server catalog can be scanned using the following command:

```shell
vet scan --image redis:latest
```

### Scanning Remote Images

`vet` will pull the image data if the container image is not available in local docker server catalog.

```shell
vet scan --image redis:latest
```

### Scanning Local Tarballs

Exported container images can be scanned using the following command:

```shell
vet scan --image /path/to/image.tar
```

This `tarball` can be created using `docker save` command. This is useful when you want to scan a container image that is not available in local docker server catalog.

```shell
docker save redis:latest -o image.tar
```

### Malicious Package Scanning

Container scanning can be combined with malware detection using the `--malware` flag. It also supports various reporting formats including `--report-cdx` and `--report-json` for generating standardized output.

```shell
vet scan --image redis:latest --malware
```

```shell
vet scan --image redis:latest --report-cdx=report.cdx.json
```

### Policy Driven Container Scanning

`vet` is designed as policy first. It uses a [Common Expression Language](https://cel.dev) based policy engine to allow flexible policies. For example, to prevent containers with malware or critical vulnerabilities from getting deployed, you can run `vet` with the following policy:

```shell
vet scan --image redis:latest --malware --filter 'vulns.critical.exists(p, true)' --filter-fail
```

**Note:** `vet` will always fail when a malicious package is detected.

### Other scanning options

For more details on how to use `vet` with container scanning, please refer to the [documentation](https://docs.safedep.io/guides/container-scanning).

## Demo

[YouTube video](https://www.youtube.com/watch?v=l-cBfp3FDYs)

## Bugs and Feedback

Found a bug or have suggestions? We'd love to hear from you! Please open an issue in our [`vet` GitHub repository](https://github.com/safedep/vet/issues). For discussions about `vet` and other SafeDep tools, join our friendly developer community on [Discord](https://docs.safedep.io/community). We're always excited to connect with fellow developers and hear your thoughts!