> ## Documentation Index
> Fetch the complete documentation index at: https://docs.corgea.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Container Image Scanning

> Container image scanning identifies known security vulnerabilities in the base images your project depends on, including operating system packages, system libraries, and other software installed within the image layers.

## Overview

* **What it Does**: Container image scanning identifies known security vulnerabilities in the container images your project uses. This includes vulnerabilities in base operating system packages, system libraries, and application packages installed within the image layers. By scanning images before deployment, you can catch security risks in containerized applications early.

* **Who it's For**: Security teams, developers, and DevOps engineers who ship containerized applications and want visibility into the vulnerabilities they inherit from base images.

## How It Works

Corgea automatically discovers the container images referenced in your project and scans each one against known vulnerability databases.

<Steps>
  <Step title="Image Discovery">
    Corgea scans your project for `Dockerfile` and Docker Compose files, then extracts the image references from them:

    * **Dockerfiles**: base images declared with `FROM` (for example, `FROM python:3.11-slim`)
    * **Docker Compose**: images declared under `image:` for each service (for example, `image: postgres:15`)

    Discovered images are de-duplicated and mapped back to the file that referenced them.
  </Step>

  <Step title="Image Analysis">
    Each image is pulled and its layers are analyzed to build an inventory of installed software — including OS/distribution packages (Debian, Ubuntu, Alpine, and others) and application packages installed inside the image.
  </Step>

  <Step title="Vulnerability Matching">
    The discovered packages are cross-referenced against known vulnerability databases, and any matches are reported alongside your other scan results.
  </Step>
</Steps>

## Supported Registries

Corgea scans images hosted on public registries:

* Docker Hub
* GitHub Container Registry (GHCR)
* Google Container Registry (GCR)
* Quay.io
* Microsoft Container Registry (MCR)
* Amazon ECR Public
* GitLab Container Registry

<Info>Container image scanning is automatically enabled when Docker files are detected in your project. No configuration is required.</Info>

## Limitations

* **Public registries only**: Images hosted on private registries are skipped.
* **Maximum image size**: Images larger than 1000 MB (1 GB) are skipped.
* Only images referenced in `Dockerfile` and Docker Compose files are discovered.

## Best Practices

<Tip>Use specific image tags (for example, `python:3.11.5-slim`) instead of `latest` for consistent, reproducible scan results.</Tip>

* **Use Specific Tags**: Avoid `latest` tags; pin exact versions so scans are reproducible.
* **Prefer Minimal Base Images**: Use slim, Alpine, or distroless variants to reduce the attack surface.
* **Regular Updates**: Keep base images updated to pick up security patches.
* **Multi-Stage Builds**: Minimize the final image size and the set of packages it includes.

## Related

* [Dependency Scanning (SCA)](/sca) — scan your application's third-party dependencies
* [Malicious Package Detection](/malware-scanning) — detect known malicious or compromised packages