Skip to main content

​
Overview

  • What it Does: Container image scanning identifies known security vulnerabilities in the container images your project uses. This includes vulnerabilities in base operating system packages, system libraries, and application packages installed within the image layers. By scanning images before deployment, you can catch security risks in containerized applications early.
  • Who it’s For: Security teams, developers, and DevOps engineers who ship containerized applications and want visibility into the vulnerabilities they inherit from base images.

​
How It Works

Corgea automatically discovers the container images referenced in your project and scans each one against known vulnerability databases.
1

Image Discovery

Corgea scans your project for Dockerfile and Docker Compose files, then extracts the image references from them:
  • Dockerfiles: base images declared with FROM (for example, FROM python:3.11-slim)
  • Docker Compose: images declared under image: for each service (for example, image: postgres:15)
Discovered images are de-duplicated and mapped back to the file that referenced them.
2

Image Analysis

Each image is pulled and its layers are analyzed to build an inventory of installed software — including OS/distribution packages (Debian, Ubuntu, Alpine, and others) and application packages installed inside the image.
3

Vulnerability Matching

The discovered packages are cross-referenced against known vulnerability databases, and any matches are reported alongside your other scan results.

​
Supported Registries

Corgea scans images hosted on public registries:
  • Docker Hub
  • GitHub Container Registry (GHCR)
  • Google Container Registry (GCR)
  • Quay.io
  • Microsoft Container Registry (MCR)
  • Amazon ECR Public
  • GitLab Container Registry
Container image scanning is automatically enabled when Docker files are detected in your project. No configuration is required.

​
Limitations

  • Public registries only: Images hosted on private registries are skipped.
  • Maximum image size: Images larger than 1000 MB (1 GB) are skipped.
  • Only images referenced in Dockerfile and Docker Compose files are discovered.

​
Best Practices

Use specific image tags (for example, python:3.11.5-slim) instead of latest for consistent, reproducible scan results.
  • Use Specific Tags: Avoid latest tags; pin exact versions so scans are reproducible.
  • Prefer Minimal Base Images: Use slim, Alpine, or distroless variants to reduce the attack surface.
  • Regular Updates: Keep base images updated to pick up security patches.
  • Multi-Stage Builds: Minimize the final image size and the set of packages it includes.