<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: scanning-container-images
description: >-
  Scan container images for CVEs, misconfigurations, embedded secrets, and supply
  chain risks using Trivy, Grype, Syft, and Cosign across CI/CD pipelines and
  container registries.
domain: cybersecurity
subdomain: container-security
tags:
  - image-scanning
  - trivy
  - grype
  - sbom
  - cosign
  - supply-chain
  - vulnerability-management
  - ci-cd
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1195.002"]
---

# Scanning Container Images

## Overview

Container image scanning identifies known vulnerabilities (CVEs), embedded secrets,
Dockerfile misconfigurations, and software supply chain risks before images reach
production. This skill covers multi-tool scanning with Trivy, Grype, and Syft,
SBOM generation, image signature verification with Cosign, and CI/CD integration
patterns for automated gate enforcement.

Mode: `[MODE: BLUE]` — Defensive vulnerability management.

## Prerequisites

| Requirement | Details |
|---|---|
| Trivy >= 0.50 installed (`brew install trivy` / `apt install trivy`) | Required |
| Grype >= 0.74 installed for cross-validation | Required |
| Syft >= 1.0 for SBOM generation | Required |
| Cosign >= 2.2 for signature verification | Required |
| Docker or Podman for local image access | Required |
| Registry credentials for private image scanning | Required |

## Key Concepts

### CVE Scanning with Trivy

```bash
# Scan image for vulnerabilities
trivy image --severity HIGH,CRITICAL --format json target:latest

# Scan with SBOM output
trivy image --format spdx-json --output sbom.json target:latest

# Scan a tar archive
docker save target:latest -o image.tar
trivy image --input image.tar

# Scan filesystem (for built images)
trivy fs --security-checks vuln,secret,config /path/to/project

# Ignore unfixed vulnerabilities
trivy image --ignore-unfixed --severity CRITICAL target:latest
```

### Cross-Validation with Grype

```bash
# Scan with Grype
grype target:latest --only-fixed --output json

# Scan from SBOM
syft target:latest -o spdx-json > sbom.json
grype sbom:sbom.json

# Compare results
trivy image --format json target:latest > trivy.json
grype target:latest --output json > grype.json
```

### Secret Detection in Image Layers

```bash
# Extract and scan layers
docker save target:latest | tar -xf - -C /tmp/layers/
for layer in /tmp/layers/*/layer.tar; do
  tar -tf "$layer" 2>/dev/null | grep -iE '\.env|id_rsa|\.pem|\.key|password|secret'
done

# Trivy secret scanning
trivy image --scanners secret target:latest

# Scan Dockerfile
trivy config Dockerfile
hadolint Dockerfile
```

### Image Signature Verification

```bash
# Generate key pair
cosign generate-key-pair

# Sign image
cosign sign --key cosign.key registry.example.com/app:v1.0

# Verify signature
cosign verify --key cosign.pub registry.example.com/app:v1.0

# Verify with keyless (Sigstore)
cosign verify --certificate-identity user@example.com \
  --certificate-oidc-issuer https://accounts.google.com \
  registry.example.com/app:v1.0
```

### CI/CD Pipeline Integration

```yaml
# GitHub Actions example
- name: Scan image
  uses: aquasecurity/trivy-action@master
  with:
    image-ref: ${{ env.IMAGE }}
    format: sarif
    output: trivy-results.sarif
    severity: HIGH,CRITICAL
    exit-code: 1

- name: Upload scan results
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: trivy-results.sarif
```

## Workflow

### Step 1: Generate SBOM

```bash
syft target:latest -o spdx-json > sbom.json
```

### Step 2: Run Multi-Scanner Analysis

```bash
node scripts/agent.js --image target:latest --output /tmp/scan-results.json
```

### Step 3: Review Findings

```bash
cat /tmp/scan-results.json | jq '.findings[] | select(.severity == "critical")'
```

### Step 4: Verify Image Signatures

```bash
cosign verify --key cosign.pub target:latest
```

## Detection

```yaml
title: Scanning Container Images Detection
id: e10a1300-b88c-4bba-af12-764c5a425c51
status: experimental
description: Detects suspicious activity related to scanning container images techniques in container security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1195.002
  - attack.execution
falsepositives:
  - Container orchestration platform performing routine health checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Scanning Container Images Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1195.002 |

## Verification

- [ ] All images scanned before deployment (zero CRITICAL unfixed CVEs)
- [ ] SBOM generated and stored for each release image
- [ ] Secret scanning enabled (no embedded credentials)
- [ ] Dockerfile passes hadolint checks
- [ ] Image signatures verified before pull
- [ ] CI/CD pipeline fails on HIGH+ severity findings
- [ ] Base images use minimal distroless or Alpine variants

## References

- [Trivy Documentation](https://aquasecurity.github.io/trivy/)
- [Grype GitHub](https://github.com/anchore/grype)
- [Cosign — Sigstore](https://docs.sigstore.dev/cosign/overview/)
- [NIST SP 800-190 — Container Security](https://csrc.nist.gov/publications/detail/sp/800-190/final)
- [CIS Docker Benchmark 4.1–4.6 — Image Security](https://www.cisecurity.org/benchmark/docker)
