Using Container Scanning to find vulnerabilities in Docker images

Container Scanning does for Docker images what Dependency Scanning does for your project’s dependencies: it checks for known vulnerabilities in the particular versions of Linux distributions that your project uses as a base when it builds Docker images.

Understanding Container Scanning

If you package and deploy your application as a Docker image – or, technically, an Open Container Initiative-compliant image – you should use GitLab’s Container Scanning feature to find known vulnerabilities in the base Linux distribution that your image is built on top of.

If you haven’t worked with Docker images before, this might sound mysterious, but it’s not complicated. Think of a Docker image as a little bit like a virtual machine. There’s a special file called Dockerfile that serves as a “recipe” for creating that virtual machine. This Dockerfile file specifies...