A base image rollup report groups container scan findings by the base image they inherit from, so you see how many findings and services trace to each base. Build it by recording each image's base and digest, tagging each finding as base layer or application layer, and counting per base.
Why roll up by base image
Container scans list every package in an image. Docker's guidance notes that smaller bases reduce vulnerabilities that come with extra dependencies, and that images are immutable snapshots, so rebuilding regularly is how you pick up patches. When many images share a base, one base update can clear a large share of findings across the fleet.
A rollup shows you which base to update first.
What the report contains
| Column | Meaning |
|---|---|
| Base image and digest | What services inherit |
| Services using it | Reach of a change |
| Findings from base layers | What a base update would remove |
| Findings from app layers | What teams must fix themselves |
| Newest available base | Whether a fix exists |
Build it in five steps
- Inventory images and record the FROM line for each. Multi-stage builds have several, so record the final stage.
- Resolve each base reference to a digest.
- Run the scan and label each finding by the layer where the package was added. Many scanners expose layer data.
- Group by base digest and count distinct services and findings.
- Sort by services times base layer findings and take the top three.
Reading the report
If a base has many services and many base layer findings, update it first. If it has few services, leave it to the owners. If a finding is in the app layer, no base update helps, and the owning team must act.
Docker also notes that rebuilding with the pull option fetches a newer base image even when a cached one exists, and that no-cache reruns every layer but does not update the base. Make sure your rebuild jobs use the right flags, or a rebuild may change nothing.
Using the report
Turn the top base into a campaign: update the base, rebuild dependents, redeploy, rescan. Keep a central, short list of approved bases so the number of rows stays small over time.
Try it yourself
Click through it at your own pace, or open it full screen. Look for how findings are tied to image layers.
Quick check
Does rebuilding always update the base image?
No. Per Docker's guidance, the pull option fetches a newer base, while no-cache only reruns build steps.
Who fixes an application layer finding?
The service owner. A base image update will not remove it.
Safeguard scans container images and can show findings per project, and you can run a free scan to look at the output.
Sources
Last reviewed: 19 October 2026.
