Scanning images for vulnerabilities in Docker - Step-by-Step Execution

Process Flow - Scanning images for vulnerabilities

Start: Docker Image Ready

↓

Run Vulnerability Scan Command

↓

Scan Tool Analyzes Image Layers

↓

Scan Tool Checks Known Vulnerabilities Database

↓

Report Vulnerabilities Found

↓

User Reviews Report and Takes Action

↓

End

The flow shows scanning a Docker image by running a scan tool that checks image layers against a vulnerability database and reports findings for user review.

Execution Sample

Docker

docker scan myapp:latest
# Output shows vulnerabilities found or none

This command scans the Docker image named 'myapp:latest' for known security vulnerabilities.

Process Table

Step	Action	Evaluation	Result
1	Start scan on image 'myapp:latest'	Image exists locally	Scan begins
2	Analyze image layers	Layers identified	Layers scanned
3	Check vulnerabilities database	Match layers with known CVEs	Vulnerabilities found: 2
4	Generate report	List vulnerabilities with severity	Report ready
5	Display report to user	User reads report	User decides next steps
6	End scan	Scan complete	Process stops

💡 Scan ends after reporting vulnerabilities found in the image

Status Tracker

Variable	Start	After Step 2	After Step 3	Final
image_name	myapp:latest	myapp:latest	myapp:latest	myapp:latest
layers_scanned	0	5	5	5
vulnerabilities_found	0	0	2	2
report_status	none	none	generated	displayed

Key Moments - 3 Insights

Why does the scan check each image layer separately?

Because Docker images are built in layers, scanning each layer helps find vulnerabilities in all parts of the image, as shown in step 2 of the execution table.

What does it mean if the vulnerabilities found is zero?

It means the scan did not find any known security issues in the image layers, so the image is considered safe at the time of scanning, as would be shown in step 3.

Why is reviewing the report important after scanning?

Because the report lists vulnerabilities and their severity, helping the user decide if they need to update or fix the image, as shown in step 5.

Visual Quiz - 3 Questions

Look at the execution table, how many vulnerabilities were found after checking the database?

A 2

B 0

C 5

D None

💡 Hint

Check the 'vulnerabilities_found' value in step 3 of the execution table.

At which step does the scan tool analyze the image layers?

A Step 1

B Step 2

C Step 4

D Step 5

💡 Hint

Look for the action describing 'Analyze image layers' in the execution table.

If no vulnerabilities were found, how would the 'vulnerabilities_found' variable change in the variable tracker?

A It would increase to 5

B It would be undefined

C It would stay at 0 after step 3

D It would decrease to -1

💡 Hint

Refer to the 'vulnerabilities_found' row in the variable tracker and imagine no vulnerabilities found.

Concept Snapshot

Docker image vulnerability scanning:
- Use 'docker scan <image>' to start
- Scans each image layer for known CVEs
- Reports vulnerabilities with severity
- Helps decide if image needs fixing
- Stops after report generation

Full Transcript

This visual execution shows how Docker scans an image for vulnerabilities. First, the scan starts on the specified image. Then, it analyzes each image layer to check for security issues. The scan tool compares layers against a vulnerability database and finds any matches. It generates a report listing vulnerabilities and their severity. Finally, the report is shown to the user who can decide what to do next. Variables like the number of layers scanned and vulnerabilities found update step-by-step. Key moments include understanding why layers are scanned separately and why reviewing the report matters. The quiz tests knowledge of steps and variable changes during scanning.

Practice

1. What is the primary purpose of running docker scan <image>?

easy

A. To find security vulnerabilities in the container image

B. To build the container image faster

C. To delete unused images from the system

D. To start a container from the image

Solution

1. Step 1: Understand the command purpose

   The docker scan <image> command is designed to analyze container images for security issues.

2. Step 2: Identify the correct use case

   It does not build, delete, or run images but scans them for vulnerabilities.

3. Final Answer:

   To find security vulnerabilities in the container image -> Option A

4. Quick Check:

   docker scan = vulnerability check [OK]

Hint: Scan images to catch security issues early [OK]

Common Mistakes:

• Confusing scanning with building images
• Thinking scan deletes images
• Assuming scan runs containers

2. Which of the following is the correct syntax to scan a Docker image named myapp:latest?

easy

A. docker scan -image myapp:latest

B. docker scan myapp:latest

C. docker scan --img myapp:latest

D. docker scan image=myapp:latest

Solution

1. Step 1: Recall the correct command syntax

   The correct syntax is docker scan <image-name> without extra flags.

2. Step 2: Verify options

   Options B, C, and D use incorrect flags or formats not supported by docker scan.

3. Final Answer:

   docker scan myapp:latest -> Option B

4. Quick Check:

   docker scan + image name = correct syntax [OK]

Hint: Use simple: docker scan image_name [OK]

Common Mistakes:

• Adding unsupported flags like -image or --img
• Using equal signs in command
• Misplacing image name

3. You run docker scan alpine:3.15 and get a report showing 2 vulnerabilities. What does this output mean?

medium

A. The scan failed and found no issues

B. The image is safe and has no vulnerabilities

C. The Alpine image has 2 known security issues to fix

D. The scan only checks for outdated packages, not vulnerabilities

Solution

1. Step 1: Interpret scan results

   The scan output listing 2 vulnerabilities means the image has 2 known security problems.

2. Step 2: Understand scan purpose

   Docker scan reports vulnerabilities, not just outdated packages or failures.

3. Final Answer:

   The Alpine image has 2 known security issues to fix -> Option C

4. Quick Check:

   Scan output = found vulnerabilities [OK]

Hint: Vulnerabilities count means issues found [OK]

Common Mistakes:

• Thinking vulnerabilities count means no issues
• Confusing scan failure with zero vulnerabilities
• Assuming scan only checks outdated packages

4. You tried docker scan myimage but got an error: ERROR: No such image: myimage. What is the likely cause?

medium

A. The image name must include a tag like ':latest'

B. The docker scan command is misspelled

C. Docker daemon is not running

D. The image 'myimage' is not present locally or in the registry

Solution

1. Step 1: Analyze error message

   The error says the image 'myimage' does not exist locally or remotely.

2. Step 2: Check common causes

   Misspelling or daemon issues cause different errors; tag is optional if 'latest' is default.

3. Final Answer:

   The image 'myimage' is not present locally or in the registry -> Option D

4. Quick Check:

   Image missing = error [OK]

Hint: Check image exists locally or remotely before scanning [OK]

Common Mistakes:

• Assuming scan command typo causes this error
• Thinking docker daemon stopped causes this error
• Believing tag is always required

5. You want to automate vulnerability scanning in your CI pipeline for image webapp:prod. Which approach is best?

hard

A. Add a step to run docker scan webapp:prod and fail if vulnerabilities found

B. Only scan images manually before deployment

C. Use docker build with a scan flag to auto-scan

D. Ignore scanning and rely on OS firewall for security

Solution

1. Step 1: Understand automation needs

   Automating scanning in CI means running docker scan during build or test steps.

2. Step 2: Evaluate options

   Manual scanning misses automation benefits; docker build has no scan flag; ignoring scanning is unsafe.

3. Final Answer:

   Add a step to run docker scan webapp:prod and fail if vulnerabilities found -> Option A

4. Quick Check:

   Automate scan + fail on issues = best practice [OK]

Hint: Automate scans in CI, fail on vulnerabilities [OK]

Common Mistakes:

• Skipping automation and scanning manually
• Expecting docker build to scan automatically
• Ignoring scanning for security