image-security-scanner

Image Security Scanner

Scan and secure Docker images for production deployment.

Quick Start

Scan an image:

docker scan myapp:latest
# or
trivy image myapp:latest

Instructions

Step 1: Choose Scanning Tool

Docker Scan (built-in):

docker scan myapp:latest

Trivy (comprehensive):

trivy image myapp:latest

Grype (fast):

grype myapp:latest

Snyk (detailed):

snyk container test myapp:latest

Step 2: Run Security Scan

Basic scan:

docker scan myapp:latest

Detailed scan with Trivy:

trivy image --severity HIGH,CRITICAL myapp:latest

Scan with JSON output:

trivy image -f json -o results.json myapp:latest

Step 3: Analyze Results

Review findings by severity:

• CRITICAL: Immediate action required
• HIGH: Fix soon
• MEDIUM: Plan to fix
• LOW: Monitor

Common vulnerabilities:

• Outdated base image
• Vulnerable packages
• Known CVEs
• Misconfigurations

Step 4: Fix Vulnerabilities

Update base image:

# Before
FROM node:18-alpine3.17

# After
FROM node:18-alpine3.18

Update packages:

RUN apk upgrade --no-cache
# or
RUN apt-get update && apt-get upgrade -y

Remove vulnerable packages:

RUN apk del vulnerable-package

Use distroless for minimal attack surface:

FROM gcr.io/distroless/nodejs18-debian11

Step 5: Implement Security Best Practices

Run as non-root:

USER nobody
# or
RUN adduser -D appuser
USER appuser

Remove unnecessary tools:

RUN apk del apk-tools

Use read-only filesystem:

# In docker-compose or k8s
read_only: true

Add security labels:

LABEL security.scan-date="2024-01-15"
LABEL security.scanner="trivy"

Step 6: Verify Fixes

Re-scan after fixes:

docker build -t myapp:latest .
trivy image myapp:latest

Compare before/after:

# Before: 15 HIGH, 5 CRITICAL
# After: 2 HIGH, 0 CRITICAL