Container vulnerability scanning in GCP - Step-by-Step Execution

Process Flow - Container vulnerability scanning

Start: Container Image Built

↓

Push Image to Container Registry

↓

Trigger Vulnerability Scan Automatically

↓

Scan Image Layers for Vulnerabilities

↓

Generate Vulnerability Report

↓

Review Report & Take Action

↓

Fix Vulnerabilities or Approve Image

↓

Deploy Image

This flow shows how a container image is scanned for vulnerabilities automatically after being pushed to the registry, then reviewed before deployment.

Execution Sample

GCP

gcloud container images list-tags gcr.io/my-project/my-app
# Lists images and scan status

# Scan runs automatically on push

# View scan results
gcloud container images describe gcr.io/my-project/my-app@sha256:<digest>

This code lists container images, shows that scanning runs automatically, and fetches vulnerability details for a specific image.

Process Table

Step	Action	Input	Process	Output
1	Build container image	Dockerfile + app code	Docker builds image layers	Image with layers created
2	Push image to registry	Image	Image uploaded to GCR	Image stored in registry
3	Trigger scan	Image push event	Container Analysis scans layers	Scan job started
4	Analyze layers	Image layers	Check for known vulnerabilities	Vulnerability data collected
5	Generate report	Scan results	Summarize vulnerabilities by severity	Report with findings
6	Review report	Vulnerability report	User or system reviews issues	Decision to fix or approve
7	Fix or approve	Decision	Patch image or approve for deploy	Image ready for deployment
8	Deploy image	Approved image	Deploy to Kubernetes or Cloud Run	Running container with scanned image
9	Exit	No more steps	Process complete	Secure container deployed

💡 All steps complete; container image scanned and deployed securely.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	After Step 7	Final
Image	None	Built with layers	Stored in registry	Scan triggered	Layers analyzed	Report generated	Reviewed	Approved or fixed	Ready for deployment
Scan Status	None	None	None	Running	Completed	Report ready	Reviewed	Approved or needs fix	Complete

Key Moments - 3 Insights

Why does the scan start automatically after pushing the image?

Because the container registry triggers the scan on image push (see execution_table step 3), ensuring every new image is checked without manual steps.

What happens if vulnerabilities are found in the report?

The report is reviewed (step 6), and the image can be fixed or approved (step 7) before deployment, preventing insecure images from running.

Is the scan part of the build or deployment process?

The scan happens after the image is built and pushed (steps 2-5), before deployment (step 8), acting as a security gate.

Visual Quiz - 3 Questions

Look at the execution_table, at which step does the vulnerability scan start?

A Step 2: Push image to registry

B Step 3: Trigger scan

C Step 5: Generate report

D Step 7: Fix or approve

💡 Hint

Check the 'Process' column in step 3 where the scan job starts.

According to variable_tracker, what is the scan status after step 4?

A None

B Running

C Completed

D Reviewed

💡 Hint

Look at the 'Scan Status' row under 'After Step 4' column.

If the image is not approved after review, which step would repeat or change?

A Step 1: Build container image

B Step 4: Analyze layers

C Step 7: Fix or approve

D Step 8: Deploy image

💡 Hint

See step 7 where the decision to fix or approve happens.

Concept Snapshot

Container vulnerability scanning in GCP:
- Build and push container image to Google Container Registry (GCR).
- Scan triggers automatically on image push.
- Container Analysis checks image layers for known vulnerabilities.
- Generates a report with severity details.
- Review report to fix or approve image before deployment.
- Ensures only secure images run in production.

Full Transcript

Container vulnerability scanning in Google Cloud Platform starts when you build a container image and push it to the Google Container Registry. Once pushed, the system automatically triggers a scan that checks the image layers for known security issues. The scan produces a report listing vulnerabilities by severity. You then review this report to decide whether to fix the issues or approve the image for deployment. This process helps keep your running containers secure by preventing vulnerable images from being deployed.

Practice

1. What is the main purpose of container vulnerability scanning in Google Cloud Platform?

easy

A. To find security issues in container images before deployment

B. To increase the speed of container startup

C. To reduce the size of container images

D. To monitor container CPU usage

Solution

1. Step 1: Understand container vulnerability scanning

   It is a process to detect security problems in container images.

2. Step 2: Identify the main goal in GCP context

   GCP uses scanning to find vulnerabilities before containers run, keeping apps safe.

3. Final Answer:

   To find security issues in container images before deployment -> Option A

4. Quick Check:

   Purpose = Find security issues [OK]

Hint: Focus on security purpose, not performance or size [OK]

Common Mistakes:

• Confusing scanning with performance monitoring
• Thinking scanning reduces image size
• Assuming scanning manages CPU usage

2. Which gcloud command correctly scans a container image named gcr.io/my-project/my-image:latest for vulnerabilities?

easy

A. gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities

B. gcloud container images scan gcr.io/my-project/my-image:latest

C. gcloud container images list-tags gcr.io/my-project/my-image:latest --vulnerabilities

D. gcloud container images scan-vulnerabilities gcr.io/my-project/my-image:latest

Solution

1. Step 1: Recall correct gcloud syntax for vulnerability scanning

   The command to view vulnerabilities is gcloud container images describe with --show-vulnerabilities.

2. Step 2: Check each option's validity

   gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities matches the correct syntax; others are invalid or do not exist.

3. Final Answer:

   gcloud container images describe gcr.io/my-project/my-image:latest --show-vulnerabilities -> Option A

4. Quick Check:

   Correct command = describe + --show-vulnerabilities [OK]

Hint: Use 'describe' with '--show-vulnerabilities' to scan images [OK]

Common Mistakes:

• Using non-existent 'scan' command
• Confusing 'list-tags' with scanning
• Omitting the '--show-vulnerabilities' flag

3. Given the command gcloud container images describe gcr.io/my-project/app:1.0 --show-vulnerabilities, what output should you expect if the image has no vulnerabilities?

medium

A. A list of vulnerabilities with severity levels

B. An error saying image not found

C. A summary of image size and tags only

D. An empty vulnerabilities section or message indicating no issues

Solution

1. Step 1: Understand the command's purpose

   The command shows vulnerability details for the specified image.

2. Step 2: Predict output when no vulnerabilities exist

   The output will show an empty vulnerabilities section or a message indicating no issues found.

3. Final Answer:

   An empty vulnerabilities section or message indicating no issues -> Option D

4. Quick Check:

   No vulnerabilities = empty or no issues message [OK]

Hint: No vulnerabilities means empty or no issues message [OK]

Common Mistakes:

• Expecting a list when none exist
• Confusing errors with no vulnerabilities
• Looking for unrelated image metadata

4. You run gcloud container images describe gcr.io/my-project/app:latest --show-vulnerabilities= but get an error: ERROR: (gcloud.container.images.describe) argument --show-vulnerabilities: Expected bool value. What is the likely cause?

medium

A. The image name is incorrect

B. You need to authenticate with gcloud first

C. You forgot to provide a value for --show-vulnerabilities flag

D. The command does not support vulnerability scanning

Solution

1. Step 1: Analyze the error message

   The error says the flag --show-vulnerabilities expects a boolean value (true or false).

2. Step 2: Identify the command mistake

   The flag was used without specifying true or false, causing the error.

3. Final Answer:

   You forgot to provide a value for --show-vulnerabilities flag -> Option C

4. Quick Check:

   Flag needs true/false value [OK]

Hint: Always provide true or false for boolean flags [OK]

Common Mistakes:

• Omitting the boolean value for flags
• Assuming image name causes this error
• Ignoring authentication errors

5. You want to automate vulnerability scanning for all container images pushed to your GCP project. Which approach best ensures every new image is scanned automatically?

hard

A. Manually run gcloud container images describe --show-vulnerabilities after each push

B. Set up Container Analysis API for automatic scanning of images on push

C. Use Stackdriver logs to detect image pushes and scan images manually

D. Schedule a daily cron job to scan all images regardless of push events

Solution

1. Step 1: Understand automation needs for scanning

   Automatic scanning requires integration with image push events.

2. Step 2: Evaluate options for automatic scanning

   Container Analysis API automatically scans images on push, ensuring no image is missed.

3. Step 3: Compare alternatives

   Manual commands or cron jobs are less efficient and risk missing images or delays.

4. Final Answer:

   Set up Container Analysis API for automatic scanning of images on push -> Option B

5. Quick Check:

   Automate scanning on push = Container Analysis API [OK]

Hint: Use triggers to scan images automatically on push [OK]

Common Mistakes:

• Relying on manual scanning after push
• Using logs instead of triggers for automation
• Scheduling scans without event triggers