فحص الصور (Image Scanning)

في هذا الدرس

scan container images and keep base images current.

الموضوعات المخطط لها

• Images carry operating-system packages as well as Java libraries; scan both (Trivy, Grype, or the registry's scanner).
• Pin the base image by version, ideally by digest, and rebuild regularly to get patches.
• Prefer small, maintained bases (distroless or slim); fewer packages means fewer findings.
• Run as a non-root user; keep build tools out of the final image with a multi-stage build.