Container Image Scanning in CI and at Runtime
Shift-left security with image scanning. Trivy, policy gates, and runtime integration.
On this page
Catching vulnerabilities in images before they run in production is a security best practice. Here’s how to do it.
In CI
- Scan every build (e.g. Trivy, Snyk, Grype) in the pipeline.
- Policy: Block or fail on CRITICAL/HIGH; warn on MEDIUM; allow LOW with tracking.
- Base image: Prefer minimal bases; track and update when base gets fixes.
trivy image --exit-code 1 --severity CRITICAL,HIGH myimage:tag
At Runtime / Registry
- Registry scanning (ECR, GCR, Harbor) for a second layer.
- Admission control: In Kubernetes, block pods whose images fail policy (e.g. Connaisseur, OPA).
Best Practices
- Fix or mitigate critical/high before release; don’t “suppress” without a ticket.
- SBOM: Generate and store software bill of materials for compliance and incident response.
- Runtime: Complement with runtime security (e.g. Falco) for behavior-based detection.
Image scanning is one part of defense in depth; combine with minimal images and supply chain signing.
Cloud Security Best Practices: Securing Your AWS Infrastructure
A working AWS security baseline, derived from the actual incidents we've had and the audit findings we've cleared.
AWS ECS vs EKS: Choosing the Right Container Platform
We run both ECS and EKS in production. Which we use for what, and the actual decision criteria — not the marketing comparison.
More from DevOps
Explore more articles in this category
GitHub Copilot CLI Sandboxing Is GA: What Actually Changed
GitHub made local sandboxing generally available for Copilot CLI on October 7, so the default now restricts the agent instead of trusting it.
The Tensorlake npm Compromise Targeted Your AI Tool Configs
A compromised npm release went after cloud credentials as expected, and local AI coding-assistant config files, which most teams never treated as secrets.
GitLab's New Rate Limits: What to Fix Before Oct 19
GitLab is capping unauthenticated API calls at 60 an hour starting October 19, and the preview windows land before most teams will have noticed.
You might have missed
Evergreen posts worth revisiting.
