Image scanning

✅ OS vulnerabilities

✅ Application dependencies (npm, pip, etc.)

✅ Misconfigurations

Here's a step-by-step procedure for handling Docker image security from scanning to taking action and continuous improvements.

---

🔍 1. Scanning Docker Images for Vulnerabilities

Before deploying an image, scan it for security issues. Use tools like Trivy, Grype, Snyk, or Docker Scout.

Steps to Scan an Image:

1.1 Scan with Trivy (Fast & Lightweight)

trivy image your-image:latest

🔹 Finds: OS vulnerabilities, libraries (pip, npm, etc.), and misconfigurations.

1.2 Scan with Grype (Deep Analysis)

grype your-image:latest

🔹 Finds: CVEs in OS and application dependencies.

1.3 Scan with Snyk (Best for Fix Recommendations)

snyk container test your-image:latest

🔹 Finds: Vulnerabilities and suggests fixes.

1.4 Scan via Docker Scout (Built into Docker Desktop)

docker scout quickview your-image:latest

🔹 Finds: Base image vulnerabilities.

Automate Image Scanning in CI/CD

• GitHub Actions Example:

jobs:
  security_scan:
    runs-on: ubuntu-latest
    steps:
      - name: Run Trivy scan
        uses: aquasecurity/trivy-action@master
        with:
          image-ref: 'your-image:latest'
          format: 'table'

---

🛠️ 2. Taking Action on Vulnerabilities

Once vulnerabilities are identified, take corrective measures.

2.1 Update Base Image

If vulnerabilities exist in your base image, update it.

🔹 Check for base image updates:

docker scout recommendations your-image:latest

🔹 Example Fix:

# Change from older image
FROM python:3.8

# Upgrade to a secure version
FROM python:3.12

2.2 Update Packages & Dependencies

For vulnerabilities in dependencies:

• Update system packages:

  apt-get update && apt-get upgrade -y

• Upgrade dependencies (e.g., pip, npm, etc.):

  pip install --upgrade -r requirements.txt

  npm update

2.3 Remove Unused Components

Minimize attack surface by removing unnecessary packages.

🔹 Reduce image size & attack surface:

FROM debian:bullseye-slim  # Use a slim variant
RUN apt-get install curl -y && rm -rf /var/lib/apt/lists/*

2.4 Use Multi-Stage Builds

This reduces vulnerabilities by keeping only required files.

# Build stage
FROM golang:1.20 as builder
WORKDIR /app
COPY . .
RUN go build -o myapp

# Production stage (no build tools)
FROM alpine:latest
COPY --from=builder /app/myapp /usr/local/bin/
ENTRYPOINT ["myapp"]

---

🚀 3. Continuous Security Improvements

3.1 Automate Scanning in CI/CD

• Integrate Trivy, Grype, or Snyk in GitHub Actions, GitLab, Jenkins.

• Example GitHub Actions pipeline:

  jobs:
    scan:
      runs-on: ubuntu-latest
      steps:
        - name: Scan with Trivy
          uses: aquasecurity/trivy-action@master
          with:
            image-ref: 'your-image:latest'
            format: 'table'

3.2 Use Distroless or Minimal Base Images

• Instead of ubuntu:latest, use gcr.io/distroless/base

FROM gcr.io/distroless/base
COPY myapp /
ENTRYPOINT ["/myapp"]

3.3 Enable Docker Content Trust (DCT)

Prevent running unsigned images.

export DOCKER_CONTENT_TRUST=1

3.4 Regularly Rotate Secrets

Use environment variables or secret managers instead of hardcoding credentials.

- name: Set secret
  run: echo $DOCKER_PASSWORD | docker login -u $DOCKER_USERNAME --password-stdin

3.5 Use Image Signing (Notary)

Sign and verify images before running.

docker trust sign myregistry/myimage:latest
docker trust inspect --pretty myregistry/myimage:latest

3.6 Implement RBAC for Image Access

Restrict who can push/pull images in registries.

{
  "rules": [
    { "role": "viewer", "users": ["dev-team"] },
    { "role": "admin", "users": ["security-team"] }
  ]
}

---

✅ Summary

Step	Action
1. Scanning	Use Trivy, Grype, Snyk to detect vulnerabilities.
2. Taking Action	Update base images, dependencies, and use multi-stage builds.
3. Improvements	Automate security in CI/CD, use minimal images, enable RBAC & DCT.

Want to implement this in a real-world project? 🚀 Let me know!