Fix vulnerabilities in images that are running and exposed before those that only sit in a registry. A registry image is a candidate for deployment, a running container is a live target. Rank by whether the image is deployed, internet facing, and built from a base you can update centrally.
Why the two lists differ
A registry can hold thousands of tags, most of them old builds nobody runs. A scan of the whole registry produces a very long report that mixes live risk with historical clutter. A scan of what is actually deployed produces a short, relevant list.
Both matter, but for different jobs. Registry scanning is a gate: it stops a bad image before release. Runtime inventory is triage: it tells you what is hurting now.
A ranking table
| Image state | Priority | Reason |
|---|---|---|
| Running in production, internet facing | Highest | Live and reachable |
| Running in production, internal only | High | Live, but fewer paths in |
| Running in staging or test | Medium | Real, but less valuable to attackers |
| Latest tag in registry, not deployed | Medium | Will deploy next, so fix before release |
| Old tags nobody runs | Low | Prune them |
Steps
- Build the running list. Ask the cluster or platform which image digests are deployed. Use digests, not tags, since tags move.
- Match scan results to it. Filter findings to those digests.
- Group by base image. Many findings come from a shared base. Updating one base fixes many services at once.
- Check what the package does. An OS package present in the image but never executed is lower risk than a library your app loads. Reachability analysis helps here.
- Rebuild and redeploy. Patching the registry copy does nothing for a container that is still running the old digest.
- Prune. Delete old tags that are no longer deployed, so they stop adding noise.
The base image shortcut
A single base image often accounts for most OS level findings across many services. Updating it and rebuilding is usually cheaper than fixing services one by one. Pin base images by digest, rebuild on a schedule, and track which services inherit from which base.
Do not forget the rebuild
A fix in a base image reaches production only after each service is rebuilt and redeployed. Track the redeploy, not just the registry update. Many "fixed" findings stay live for weeks because nobody rebuilt.
Try it yourself
Open the demo and scan an image. Look at which findings sit in the base layers and which in the application layer.
Click through it at your own pace, or open it full screen.
Quick check
Should I scan the registry or the running cluster?
Both. Scan the registry as a release gate, and use the running inventory to decide what is urgent.
Why use digests instead of tags?
A tag can point to a different image tomorrow. A digest identifies exactly what is deployed.
Safeguard includes container image scanning alongside SBOM and dependency scanning, and you can try a free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
