Scanning images for vulnerabilities in Docker - Practice Problems & Coding Challenges

Challenge - 5 Problems

💻 Command Output

intermediate

Output of Docker image vulnerability scan using Trivy

You run the command trivy image alpine:3.18 to scan the Alpine Linux Docker image for vulnerabilities. What is the expected type of output you will see?

Docker

trivy image alpine:3.18

A A list of detected vulnerabilities with severity levels, package names, and fixed versions if available.

B A summary showing only the total number of layers in the image without vulnerability details.

C An error message stating 'image not found' because Alpine images cannot be scanned.

D A JSON output showing only the image size and creation date without any vulnerability info.

💡 Hint

Trivy scans images and reports vulnerabilities with details like severity and fixes.

Trivy scans container images and outputs detected vulnerabilities with details such as severity, affected packages, and fixed versions if available. It does not just show image metadata or layer counts.

🧠 Conceptual

intermediate

Understanding vulnerability scanning in CI/CD pipelines

Why is it important to include Docker image vulnerability scanning as part of a CI/CD pipeline?

A To detect and fix security issues early before deploying containers to production.

B To increase the build time significantly for better resource usage.

C To reduce the size of the Docker image by removing unused packages.

D To automatically update the base image without manual intervention.

💡 Hint

Think about security risks and deployment safety.

Including vulnerability scanning in CI/CD helps catch security problems early, preventing vulnerable containers from reaching production environments.

❓ Troubleshoot

advanced

Troubleshooting Trivy scan failure due to missing Docker daemon

You run trivy image myapp:latest on a server without Docker installed and get an error. What is the most likely cause?

Docker

trivy image myapp:latest

A The network connection is down, so Trivy cannot reach the vulnerability database.

B Trivy cannot find the Docker daemon to pull or inspect the image locally.

C Trivy requires root privileges to run the scan and you ran it as a normal user.

D The image name is invalid and Trivy cannot parse it.

💡 Hint

Trivy needs to access the image locally or remotely.

Without Docker installed or running, Trivy cannot pull or inspect local images, causing scan failures.

❓ Configuration

advanced

Configuring Trivy to ignore low severity vulnerabilities

Which Trivy command option correctly configures the scan to report only vulnerabilities with severity HIGH or CRITICAL?

A trivy image --severity-level HIGH,CRITICAL myapp:latest

B trivy image --ignore-severity LOW,MEDIUM myapp:latest

C trivy image --only-severity HIGH,CRITICAL myapp:latest

D trivy image --severity HIGH,CRITICAL myapp:latest

💡 Hint

Check Trivy's official option for severity filtering.

The correct option is --severity followed by a comma-separated list of severities to include in the report.

✅ Best Practice

expert

Best practice for scanning multi-stage Docker builds

In a multi-stage Dockerfile, which stage should you scan for vulnerabilities to ensure the final image is secure?

A Only scan the final stage image because it is the one deployed.

B Scan only the first stage since it contains the base OS.

C Scan all stages separately to catch vulnerabilities in build dependencies.

D Scanning is unnecessary for multi-stage builds as they are secure by default.

💡 Hint

Think about hidden vulnerabilities in build stages.

Scanning all stages helps detect vulnerabilities in build dependencies that might affect the build process or leak into the final image.