Container image security
Container security articles
Image layers, base images and the binding between an image digest and the workload that runs it.
Container image security covers vulnerabilities in image layers and base images, and which running workloads actually use a given image digest. These articles cover layer-aware image scanning, binding images to workloads by digest, and prioritising container vulnerabilities with CISA KEV, FIRST EPSS and reachability.
- Open-source container image scanners: Trivy, Grype, SyftOpen-source container image scanning tools compared: what Trivy, Grype, Syft and Dockle each find, where they disagree, and how to run them in CI. · Sujan Singh
- Build provenance: verify the image you deployVerify container build provenance against the image digest, trusted builder and approved source, then retain the evidence behind deployment decisions. · Sujan Singh
- How to prioritise container vulnerabilities: KEV, EPSS, reachPrioritise container vulnerabilities with CISA KEV, FIRST EPSS, reachability and image-to-workload exposure, so the short list is what attackers would use. · Sujan Singh
- Container image scanning: layers, base images and real fixesContainer image scanning that separates base-image, OS package and application dependency findings, so each goes to the team that can fix it. · Sujan Singh
- Container images to workloads: bind by digest, not by tagBind container images to workloads by digest, so vulnerabilities are prioritised by what is deployed and reachable, not by what sits in a registry. · Sujan Singh
See it on your stack
See connected security in action.
Explore the workflow with your engineering, security and compliance teams. No repository access is needed for the initial demonstration.