Usually not. A repository dependency scan reads library manifests. A Compose or Kubernetes file only names an image, and the packages inside that image are never listed in your repository. Unless the scanner also pulls and scans the named images, they sit outside coverage.
What the file actually says
The Compose file reference documents the image attribute of a service, which names the container image to start. That is a name and a tag, nothing more. The contents of the image, its operating system packages and libraries, are defined elsewhere, usually in someone else's build.
Kubernetes manifests work the same way: a container spec carries an image reference. Your repository records which images you run, not what they contain.
Why this is a real gap
Databases, proxies and message queues in a Compose stack often come from public images you never build. They may have more known vulnerabilities than your own code, and no manifest scan will say so.
| Source of image | Who patches | Seen by repo scan |
|---|---|---|
| Built from your Dockerfile | You | Dockerfile and source only |
| Pulled from a public registry | Publisher, then you pull | Name only |
| Internal shared base | Platform team | Name only |
Close the gap in four steps
- Extract every image reference from Compose files and Kubernetes manifests in the repository, with a simple search for the image key.
- Write them to an inventory file with name and tag, one per line.
- Pin each to a digest where possible, so what you scan is what runs. A moving tag such as latest can change under you.
- Scan every listed image with an image scanner, on a schedule, not only at build time.
A quick extraction looks like this.
grep -rhoE 'image:[[:space:]]*[^[:space:]]+' --include='*.yml' --include='*.yaml' . | sort -u
Watch for variables
Image names set through variables or templating will not show up as literal text. Render the final manifests, or read the images from the running cluster, to get the true list.
Keep it fresh
Images age even when nothing changes in your repository. A tag you pulled six months ago may now carry known flaws. Schedule rescans. See a clean build time scan is a snapshot.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what an image scan lists, then compare with what a Compose file contains.
Safeguard offers SBOM and dependency scanning and a free scan at gold.safeguard.sh/scan. Pair repo scans with an image inventory.
Quick check
Do I need to scan images I did not build?
Yes, if you run them. Your exposure comes from what runs, not who built it.
Is pinning to a digest necessary?
It is not required, but it makes scan results match what actually runs.
Sources
Last reviewed: 19 October 2026.
