<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Container Image Scanning — API Reference

## Trivy Image

```bash
# Scan local image
trivy image app:latest --severity HIGH,CRITICAL --format json

# Exit code on findings
trivy image app:latest --severity CRITICAL --exit-code 1

# Ignore unfixed
trivy image app:latest --ignore-unfixed

# Scan remote registry
trivy image ghcr.io/org/app:v1.2.3

# SARIF output
trivy image app:latest --format sarif --output results.sarif

# Scan tar archive
trivy image --input app.tar --format json
```

## Grype

```bash
# Scan image
grype app:latest --output json

# Fail on severity
grype app:latest --fail-on high

# Scan tar
grype app.tar --output json

# Scan SBOM
grype sbom:sbom.cdx.json

# Scan directory
grype dir:/path/to/app
```

## Snyk Container

```bash
# Test container
snyk container test app:latest --severity-threshold=high --json

# Monitor container
snyk container monitor app:latest --org=my-org

# With Dockerfile (better remediation)
snyk container test app:latest --file=Dockerfile --json
```

## Dockerfile Linting

```bash
# Hadolint
hadolint Dockerfile --format json

# Dockle (CIS Docker Benchmark)
dockle app:latest --format json --output dockle-results.json

# Trivy config
trivy config Dockerfile --severity HIGH,CRITICAL
```

## Base Image Comparison

| Image | Size | CVEs (typical) |
|-------|------|----------------|
| ubuntu:22.04 | ~77MB | Medium |
| alpine:3.19 | ~7MB | Low |
| python:3.12-slim | ~130MB | Medium |
| gcr.io/distroless/static | ~2MB | Minimal |
| scratch | 0MB | None |
