Identifying Container Image Vulnerabilities with Docker Scout
A guide on how to maintain a more secure containerized software.
Introduction
We all know, that Docker technology is great and brings us many advantages, but also, unfortunately, Docker images include many attack surfaces on different layers.
Every day, there are new vulnerabilities discovered in open source projects and maintainers are tasked with patching their software. ~30k new vulnerabilities discovered in 2023 alone.
So how can we mitigate this risk? One solution is vulnerability scanning and its integration into your development lifecycle.
There are many free, open-source but also paid tools for Docker vulnerability scanning:
Docker Scout
Aqua Security Trivy
Snyk
tenable.io
and many others…
They all have their advantages and differences, but still share the main goal: identify unpatched vulnerabilities.
Docker Scout Example
Let's take a deep dive into the Docker vulnerability scanning and see it in action! We will:
Craft a sample Dockerfile as a foundation for our exploration.
Scan for vulnerabilities with Docker Scout.
Explore some resolution options.
Set up a simple CI/CD pipeline to automate continuous scanning/reporting.
Our Dockerfile will use golang:1.19 as a base image, which is not the latest version, but not so old either, and I believe many projects still use it.
