Scan images for vulnerabilities in CI

Approach

Scan the built image with Docker Scout or Trivy, fail the build only on critical or high vulnerabilities that have a fix available, and rebuild regularly on patched bases.

Solution

docker scout cves --only-severity critical,high --only-fixed --exit-code app:dev
# or
trivy image --severity CRITICAL,HIGH --ignore-unfixed --exit-code 1 app:dev

Pitfalls

• Failing builds on every unfixed low-severity finding: teams learn to ignore the scanner.
• Scanning once at build time only; new CVEs appear for old images, so scan running images too.

Variations

• Generate an SBOM (docker buildx build --sbom=true) and scan it continuously.
• Track base image freshness and rebuild weekly.

Further reading: Docker Scout