Container Image Scanning in CI and at Runtime
Shift-left security with image scanning. Trivy, policy gates, and runtime integration.
Key takeaways
- Shift-left security with image scanning.
- Trivy, policy gates, and runtime integration.
On this page
Container Image Scanning in CI and at Runtime#
Catching vulnerabilities in images before they run in production is a security best practice. Here’s how to do it.
In CI#
- Scan every build (e.g. Trivy, Snyk, Grype) in the pipeline.
- Policy: Block or fail on CRITICAL/HIGH; warn on MEDIUM; allow LOW with tracking.
- Base image: Prefer minimal bases; track and update when base gets fixes.
trivy image --exit-code 1 --severity CRITICAL,HIGH myimage:tag
At Runtime / Registry#
- Registry scanning (ECR, GCR, Harbor) for a second layer.
- Admission control: In Kubernetes, block pods whose images fail policy (e.g. Connaisseur, OPA).
Best Practices#
- Fix or mitigate critical/high before release; don’t “suppress” without a ticket.
- SBOM: Generate and store software bill of materials for compliance and incident response.
- Runtime: Complement with runtime security (e.g. Falco) for behavior-based detection.
Image scanning is one part of defense in depth; combine with minimal images and supply chain signing.
Get the DevOps Troubleshooting Cheat Sheet
Subscribe and get our free one-page reference for the errors that eat an afternoon — CrashLoopBackOff, OOMKilled, Terraform state locks, and more — plus new guides as we publish them.
Cloud Security Best Practices: Securing Your AWS Infrastructure
A working AWS security baseline, derived from the actual incidents we've had and the audit findings we've cleared.
AWS ECS vs EKS: Choosing the Right Container Platform
We run both ECS and EKS in production. Which we use for what, and the actual decision criteria — not the marketing comparison.
More from DevOps
Explore more articles in this category
Best Kubernetes IDE and GUI Tools in 2026
kubectl is fine until you're juggling five namespaces across three clusters. These are the tools that make that manageable, compared.
Chef vs Puppet vs Ansible: Configuration Management in 2026
One is agentless and Python-based, the other two run a persistent agent and a domain-specific language. The architecture difference matters more than the syntax.
PagerDuty vs Opsgenie: Choosing an Incident Alerting Tool
Both page the right person at 3am and both integrate with everything. The real differences show up in pricing structure, workflow depth, and who already owns the ecosystem around you.
You might have missed
Evergreen posts worth revisiting.
