To scan a GPU inference container image, scan the finished image rather than only your requirements file, covering OS packages, GPU runtime libraries, Python packages, and your application layer. Generate an SBOM during the build, fail the pipeline on reachable critical findings, and rescan deployed images on a schedule.
What is inside the image
A serving image usually stacks four layers, and each one has its own source of vulnerabilities.
| Layer | Examples | Who patches it |
|---|---|---|
| Base OS | Distribution packages, shell, certificates | You, by rebuilding on a newer base |
| GPU and system libraries | Vendor runtime libraries pulled in by the base image | You, by choosing a newer base tag |
| Python environment | Framework, serving runtime, tokenizers, transitive packages | You, through lockfile updates |
| Your application | Handlers, auth, tenant logic | You, through code changes |
Scanning only the Python lockfile misses the first two rows. Scanning only the image can hide which of your own dependencies introduced a finding. Do both and join the results.
Steps
- Pin the base image by version tag, and by digest in production, so rebuilds are repeatable.
- Generate an SBOM at build time. Docker BuildKit can attach one with the flag
--attest type=sbom(shorthand--sbom=true), which stores the inventory with the image. UseBUILDKIT_SBOM_SCAN_STAGEif you use multi stage builds and want earlier stages included. - Scan the image against vulnerability data and rank findings by reachability and exposure.
- Gate the pipeline on new critical, reachable findings, not on the total count.
- Rescan what is already deployed. New advisories appear after you ship, so a clean scan on release day does not stay clean.
- Trim the image. Multi stage builds that leave compilers and build tools behind shrink what can be flagged and what an attacker can use.
Common mistakes
- Treating model weights as part of the scan. Weight files are data and need provenance and format checks, which an image scanner does not give you. See loading weights safely.
- Baking secrets into layers. A deleted file can still sit in an earlier layer.
- Pulling a floating tag in production.
Try it yourself
Run the container image scan demo. Look at which findings come from the OS layer and which from Python packages.
Click through it at your own pace, or open it full screen.
A short note on Safeguard
Safeguard scans container images, produces SBOMs, and applies policy gates in CI. Try a free scan at gold.safeguard.sh/scan.
Quick check
Do GPU images need a different scanner?
No special scanner is needed. The image is still OS packages and language packages. What differs is that the base is larger, so rebuilds on newer bases matter more.
How often should deployed images be rescanned?
On a schedule and whenever a high profile advisory lands. Daily is common for production images.
Sources
Last reviewed: 19 October 2026.
