Blog

Container and IaC Scanning: Image Vulnerabilities, Base Image Choice and Manifest Scanning

Image scanning checks the operating system packages and the application dependencies of the artifact you actually deploy; most findings come from unused packages, and a chiseled, non-root base image removes most of them. With real output we show the Bookstore image dropping from 42 findings to 6, how Trivy and Grype differ, verifying the scanner with a SHA pin and a cosign signature after the March 2026 Trivy incident, and Dockerfile, Kubernetes and Terraform scanning.