Image Scanning

A scanner that reports everything is indistinguishable from one that reports nothing — teams stop reading a 400-line CVE list after the first week. The job of scanning is not to find every issue, it's to find the ones worth someone's attention and force a decision on them before the image ships.

A finding without a decision (fix, accept, or block) is just noise with a CVE number attached.

1. Scan at build time, not just at rest

A scan that runs only against images already sitting in the registry catches problems after they've potentially been deployed. Scan in the CI pipeline immediately after build, before push, so a critical finding blocks promotion rather than triggering a retroactive scramble. Also re-scan images already in the registry periodically — a base image with zero known CVEs today can have a new one disclosed next week against the same digest, so freshness at build time is not sufficient on its own.

Done when: every image is scanned before it is pushed to a registry other images pull from.