Container Security Scanning: Protecting Your Containerized Infrastructure

Containerization has revolutionized software deployment, offering consistency, scalability, and efficiency. However, containers also introduce new security challenges. Container security scanning provides visibility into vulnerabilities across the container lifecycle—from image creation through runtime execution. This guide covers comprehensive container security scanning strategies.​‌‌​​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌​‍​‌‌‌​‌​​‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​‌‌​​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​​‌‌‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​‌‌​‌‌‌​‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌​​‌‌‌

Why Container Security Matters

Containers package applications with their dependencies, creating potential security risks:

• Vulnerable base images may contain unpatched software
• Layered dependencies create complex attack surfaces
• Shared kernel requires proper isolation
• Immutable nature makes traditional patching challenging
• Rapid deployment can outpace security reviews

Container Security Scanning Layers

Effective container security requires scanning at multiple levels:​‌‌​​​‌‌‍​‌‌​‌‌‌‌‍​‌‌​‌‌‌​‍​‌‌‌​‌​​‍​‌‌​​​​‌‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌​​‌​‌‍​‌‌‌​​‌​‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​‌​‌‍​‌‌​​​‌‌‍​‌‌‌​‌​‌‍​‌‌‌​​‌​‍​‌‌​‌​​‌‍​‌‌‌​‌​​‍​‌‌‌‌​​‌‍​​‌​‌‌​‌‍​‌‌‌​​‌‌‍​‌‌​​​‌‌‍​‌‌​​​​‌‍​‌‌​‌‌‌​‍​‌‌​‌‌‌​‍​‌‌​‌​​‌‍​‌‌​‌‌‌​‍​‌‌​​‌‌‌

1. Base Image Scanning

Start security at the foundation:

Vulnerability Sources:

• Operating system packages (apt, yum, apk)
• System libraries and binaries
• Pre-installed applications
• Configuration files

Scanning Best Practices:

• Scan official images before customization
• Use minimal base images (Al pine, distroless)
• Regularly update base images
• Verify image provenance and signatures
• Maintain approved base image registry

2. Application Dependency Scanning

Applications bring their own vulnerabilities:

Package Managers:

• npm/yarn for Node.js
• pip for Python
• Maven/Gradle for Java
• Bundler for Ruby
• Go modules

Scanning Focus Areas:

• Known CVEs in dependencies
• Outdated package versions
• License compliance
• Transitive dependencies
• Unmaintained packages

3. Configuration Scanning

Misconfigurations are common attack vectors:

Dockerfile Security Checks:

• Running as non-root user
• Minimal required capabilities
• No sensitive data in environment variables
• Proper resource limits
• Health checks defined

Kubernetes Manifest Security:

• Pod security policies
• Network policies
• RBAC configurations
• Security contexts
• Resource quotas

Container Image Scanning Tools

Open Source Scanners

Trivy (Aqua Security):

# Scan a local image
trivy image myapp:latest

# Scan with severity filter
trivy image --severity HIGH,CRITICAL myapp:latest

# Generate JSON report
trivy image --format json --output report.json myapp:latest

• Comprehensive vulnerability database
• OS and application package scanning
• Infrastructure as Code scanning
• Fast scanning with caching

Grype (Anchore):

# Scan image from registry
grype registry:myregistry/myapp:latest

# Scan with specific scope
grype --scope all-layers myapp:latest

• Syft integration for SBOM generation
• CycloneDX and SPDX export
• Configurable vulnerability sources

Clair (Red Hat/Quay):

• Layer-by-layer analysis
• API-first design
• Integration with registries
• Continuous monitoring capability

Commercial Solutions

Aqua Security:

• Full lifecycle protection
• Runtime security
• Network micro-segmentation
• Compliance reporting

Snyk Container:

• Developer-friendly interface
• Fix recommendations
• IDE integrations
• Automated PRs for fixes

Qualys Container Security:

• Cloud-native approach
• Agentless scanning
• Policy enforcement
• Cloud platform integration

Implementing Scanning in CI/CD

Integrate security scanning into your pipeline:

Pre-Build Scanning

# GitHub Actions example
name: Container Security Scan
on: [push, pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Build image
        run: docker build -t myapp:test .
      
      - name: Run Trivy vulnerability scanner
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'myapp:test'
          format: 'sarif'
          output: 'trivy-results.sarif'
      
      - name: Upload scan results
        uses: github/codeql-action/upload-sarif@v2
        with:
          sarif_file: 'trivy-results.sarif'

Registry Scanning

# Scan images in registry
- name: Scan registry image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: 'myregistry/myapp:${{ github.sha }}'
    scan-type: 'image'
    severity: 'CRITICAL,HIGH'
    exit-code: '1'

Policy-Based Gates

# Fail build on critical vulnerabilities
if [ $(trivy image --severity CRITICAL --quiet myapp:latest | wc -l) -gt 0 ]; then
  echo "Critical vulnerabilities found. Blocking deployment."
  exit 1
fi

Runtime Security Scanning

Static scanning isn't enough—monitor running containers:

Container Runtime Protection

Behavioral Monitoring:

• Process execution monitoring
• File system access tracking
• Network connection analysis
• System call filtering

Falco (CNCF Project):

# Example Falco rule
- rule: Unexpected Outbound Connection
  desc: Detect outbound connections from containers
  condition: >
    outbound and
    container and
    not allowed_outbound_ports
  output: >
    Outbound connection from container
    (user=%user.name command=%proc.cmdline connection=%fd.name)
  priority: WARNING

Network Security Scanning

• Service mesh traffic analysis
• East-west traffic inspection
• Anomaly detection
• Micro-segmentation validation

Software Bill of Materials (SBOM)

Maintain visibility into container contents:

SBOM Generation

# Generate SBOM with Syft
syft myapp:latest -o spdx-json > sbom.spdx.json

# Generate CycloneDX format
syft myapp:latest -o cyclonedx-json > sbom.cyclonedx.json

SBOM Benefits

• Complete component inventory
• Vulnerability impact analysis
• License compliance tracking
• Supply chain transparency
• Incident response acceleration

Vulnerability Management Workflow

Scanning Frequency

Stage	Frequency	Scope
Development	Every commit	Changed layers
CI/CD	Every build	Full image
Registry	Daily	All stored images
Runtime	Continuous	Active containers

Remediation Priorities

1. Critical vulnerabilities in exposed services
2. High severity issues in base images
3. Medium severity in application dependencies
4. Configuration drift from hardening baselines

Patching Strategies

Rebuilding Approach:

# Pin to specific base image version
FROM alpine:3.18.4

# Regular rebuild picks up patches
RUN apk update && apk upgrade

Layer Caching Strategy:

• Separate dependency installation from application code
• Update base images regularly
• Use multi-stage builds for minimal final images

Compliance and Reporting

Security Benchmarks

CIS Docker Benchmark:

• Host OS configuration
• Docker daemon settings
• Docker Swarm configuration
• Container runtime policies

CIS Kubernetes Benchmark:

• Control plane components
• etcd configuration
• Worker node security
• Policies and procedures

Automated Compliance Scanning

# Docker Bench for Security
docker run --rm --net host --pid host --userns host \
  --cap-add audit_control \
  -v /var/lib:/var/lib \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /usr/lib/systemd:/usr/lib/systemd \
  -v /etc:/etc --label docker_bench_security \
  docker/docker-bench-security

Best Practices Summary

Image Creation

• Use official, minimal base images
• Pin specific versions, not "latest"
• Multi-stage builds to reduce attack surface
• Regular base image updates
• Signed and verified images only

Registry Management

• Private registries with authentication
• Vulnerability scanning on push
• Image signing and verification
• Retention policies for old images
• Access control and audit logging

Runtime Security

• Read-only root filesystems
• Non-root container execution
• Resource limits and quotas
• Security contexts and policies
• Continuous runtime monitoring

Organizational Practices

• Security training for container developers
• DevSecOps culture integration
• Incident response procedures
• Regular security assessments
• Continuous improvement processes

Conclusion

Container security scanning is essential for modern infrastructure security. By implementing comprehensive scanning across the container lifecycle—from base images through runtime—you can significantly reduce your attack surface and respond quickly to emerging threats.

Remember that scanning is just one component of container security. Combine it with secure development practices, proper configuration management, and runtime protection for defense in depth.

---

Need help implementing container security scanning? lil.security offers container security assessments and CI/CD integration services.