Container Scanning
Container scanning is a method that inspects container images layer by layer to inventory installed OS packages and application dependencies, matching them against vulnerability databases and checking for misconfigurations, outdated base images, and embedded secrets.
A container image bundles an application together with its operating-system packages, libraries, and configuration. Container scanning analyzes that full image, examining each filesystem layer to enumerate the OS packages (via the distro package manager metadata) and language dependencies it ships.
The scanner matches those components against vulnerability feeds such as the NVD and distro-specific advisories to report known CVEs, and it commonly checks for related risks: end-of-life or outdated base images that no longer receive patches, insecure Dockerfile practices (running as root, exposed ports), and secrets baked into layers. Results are tied to specific packages and fixed versions where available.
For developers shipping containers, scanning fits into the image-build pipeline and registry, catching vulnerable dependencies before images are deployed. Because it works from image metadata and advisories, coverage depends on the scanner understanding the base OS and package formats present in the image.