Image scanning
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
scan container images and keep base images current.
Planned topics
- Images carry operating-system packages as well as Java libraries; scan both (Trivy, Grype, or the registry's scanner).
- Pin the base image by version, ideally by digest, and rebuild regularly to get patches.
- Prefer small, maintained bases (distroless or slim); fewer packages means fewer findings.
- Run as a non-root user; keep build tools out of the final image with a multi-stage build.
Draft outline details
Demonstration
trivy image --severity HIGH,CRITICAL --exit-code 1 shop/orders:1.4.2 failing the build on findings.
Check your understanding
Why pin the base image?
Show answer
So builds are reproducible and updates are deliberate, not accidental.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.