Scanning images for vulnerabilities in Docker - Commands & Configuration

Introduction

When you use software containers, sometimes they can have security problems hidden inside. Scanning images for vulnerabilities helps find these problems before you run the containers, keeping your system safe.

Before deploying a new version of your app to make sure it has no known security issues.

When you pull a container image from the internet and want to check it is safe.

Regularly scanning your images to catch new vulnerabilities found after you built them.

Before sharing your container images with others to ensure they are secure.

When you want to comply with security rules that require vulnerability checks.

Commands

This command scans the official nginx image version 1.23 for known security vulnerabilities using Docker's built-in scanning tool.

Terminal

docker scan nginx:1.23

Expected Output

Testing nginx:1.23



Organization: docker-library

Package manager: apk

Project name: nginx

Project version: 1.23



✓ Tested 50 dependencies for known issues, no vulnerable paths found.





For more information, visit https://docs.docker.com/scan/

Scan your own built image named my-app with the latest tag to find vulnerabilities before deployment.

Terminal

docker scan my-app:latest

Expected Output

Testing my-app:latest



Organization: my-org

Package manager: deb

Project name: my-app

Project version: latest



✗ 2 vulnerabilities found



Severity: High

Description: CVE-2023-12345 in openssl

More info: https://security-tracker.example.com/CVE-2023-12345



Severity: Medium

Description: CVE-2022-67890 in curl

More info: https://security-tracker.example.com/CVE-2022-67890



Run 'docker scan --json my-app:latest' for detailed output.

Run the scan again but output the results in JSON format for easier automated processing or reporting.

Terminal

docker scan --json my-app:latest

Expected Output

{

  "vulnerabilities": [

    {

      "id": "CVE-2023-12345",

      "severity": "High",

      "package": "openssl",

      "description": "Buffer overflow vulnerability",

      "link": "https://security-tracker.example.com/CVE-2023-12345"

    },

    {

      "id": "CVE-2022-67890",

      "severity": "Medium",

      "package": "curl",

      "description": "Information disclosure",

      "link": "https://security-tracker.example.com/CVE-2022-67890"

    }

  ]

}

→

--json - Outputs the scan results in JSON format for easier parsing.

Key Concept

If you remember nothing else from this pattern, remember: scanning container images before use helps catch security problems early and keeps your systems safe.

Common Mistakes

Running docker scan on an image that does not exist locally or remotely.

The scan will fail because Docker cannot find the image to analyze.

Make sure the image is built locally or pulled from a registry before scanning.

Ignoring scan results that show vulnerabilities.

This leaves your system exposed to known security risks that could be exploited.

Review vulnerabilities carefully and update or fix the image before deployment.

Using outdated Docker versions that do not support the docker scan command.

The scan command will not work or may produce errors.

Use Docker version 20.10 or later where docker scan is supported.

Summary

Use 'docker scan IMAGE_NAME' to check container images for known security vulnerabilities.

Review the scan output carefully and fix any found issues before deploying containers.

Use the '--json' flag to get machine-readable scan results for automation or reporting.

Practice

1. What is the primary purpose of running docker scan <image>?

easy

A. To find security vulnerabilities in the container image

B. To build the container image faster

C. To delete unused images from the system

D. To start a container from the image

Solution

1. Step 1: Understand the command purpose

   The docker scan <image> command is designed to analyze container images for security issues.

2. Step 2: Identify the correct use case

   It does not build, delete, or run images but scans them for vulnerabilities.

3. Final Answer:

   To find security vulnerabilities in the container image -> Option A

4. Quick Check:

   docker scan = vulnerability check [OK]

Hint: Scan images to catch security issues early [OK]

Common Mistakes:

• Confusing scanning with building images
• Thinking scan deletes images
• Assuming scan runs containers

2. Which of the following is the correct syntax to scan a Docker image named myapp:latest?

easy

A. docker scan -image myapp:latest

B. docker scan myapp:latest

C. docker scan --img myapp:latest

D. docker scan image=myapp:latest

Solution

1. Step 1: Recall the correct command syntax

   The correct syntax is docker scan <image-name> without extra flags.

2. Step 2: Verify options

   Options B, C, and D use incorrect flags or formats not supported by docker scan.

3. Final Answer:

   docker scan myapp:latest -> Option B

4. Quick Check:

   docker scan + image name = correct syntax [OK]

Hint: Use simple: docker scan image_name [OK]

Common Mistakes:

• Adding unsupported flags like -image or --img
• Using equal signs in command
• Misplacing image name

3. You run docker scan alpine:3.15 and get a report showing 2 vulnerabilities. What does this output mean?

medium

A. The scan failed and found no issues

B. The image is safe and has no vulnerabilities

C. The Alpine image has 2 known security issues to fix

D. The scan only checks for outdated packages, not vulnerabilities

Solution

1. Step 1: Interpret scan results

   The scan output listing 2 vulnerabilities means the image has 2 known security problems.

2. Step 2: Understand scan purpose

   Docker scan reports vulnerabilities, not just outdated packages or failures.

3. Final Answer:

   The Alpine image has 2 known security issues to fix -> Option C

4. Quick Check:

   Scan output = found vulnerabilities [OK]

Hint: Vulnerabilities count means issues found [OK]

Common Mistakes:

• Thinking vulnerabilities count means no issues
• Confusing scan failure with zero vulnerabilities
• Assuming scan only checks outdated packages

4. You tried docker scan myimage but got an error: ERROR: No such image: myimage. What is the likely cause?

medium

A. The image name must include a tag like ':latest'

B. The docker scan command is misspelled

C. Docker daemon is not running

D. The image 'myimage' is not present locally or in the registry

Solution

1. Step 1: Analyze error message

   The error says the image 'myimage' does not exist locally or remotely.

2. Step 2: Check common causes

   Misspelling or daemon issues cause different errors; tag is optional if 'latest' is default.

3. Final Answer:

   The image 'myimage' is not present locally or in the registry -> Option D

4. Quick Check:

   Image missing = error [OK]

Hint: Check image exists locally or remotely before scanning [OK]

Common Mistakes:

• Assuming scan command typo causes this error
• Thinking docker daemon stopped causes this error
• Believing tag is always required

5. You want to automate vulnerability scanning in your CI pipeline for image webapp:prod. Which approach is best?

hard

A. Add a step to run docker scan webapp:prod and fail if vulnerabilities found

B. Only scan images manually before deployment

C. Use docker build with a scan flag to auto-scan

D. Ignore scanning and rely on OS firewall for security

Solution

1. Step 1: Understand automation needs

   Automating scanning in CI means running docker scan during build or test steps.

2. Step 2: Evaluate options

   Manual scanning misses automation benefits; docker build has no scan flag; ignoring scanning is unsafe.

3. Final Answer:

   Add a step to run docker scan webapp:prod and fail if vulnerabilities found -> Option A

4. Quick Check:

   Automate scan + fail on issues = best practice [OK]

Hint: Automate scans in CI, fail on vulnerabilities [OK]

Common Mistakes:

• Skipping automation and scanning manually
• Expecting docker build to scan automatically
• Ignoring scanning for security