SCA reads what you declared in manifests and lockfiles. Container scanning reads what is actually inside the built image, including operating system packages and anything a base image added. They report some of the same libraries, but each sees packages the other cannot, so teams that ship containers usually run both.
Different inputs, different truths
An SCA tool starts from files in your repository. A lockfile says which versions your build intends to install. A container scanner starts from the finished artifact and unpacks its layers.
Trivy's documentation shows the scope of an image scan: installed OS packages from managers such as dpkg, yum and apk, plus language packages from ecosystems such as pip, npm and gem. It notes OS coverage is for official vendor packages, not third party or self compiled software.
What only container scanning sees
- OS packages in the base image that no manifest of yours mentions.
- Packages added by a Dockerfile step, such as a system library installed for convenience.
- Drift between what the lockfile asked for and what the build resolved.
- Tools left in the image that are not needed at runtime.
What only SCA sees
- Dependencies in projects that are never containerised, such as libraries, CLIs and mobile apps.
- Problems early in development, before any image exists.
- Licence data tied to the declared dependency graph.
- Dev dependencies that never reach the image but still run on build machines.
Where they double count
When the same npm package appears in your lockfile and in the image, both tools report it. That is fine if findings are merged by component and version. It becomes a headache if two teams each get a ticket. Decide which tool owns a finding type. A common split is that SCA owns application libraries and container scanning owns the OS layer.
A practical sequence
- Run SCA in pull requests so a vulnerable library is caught before merge.
- Scan the image at build time and again when it is stored in a registry, because new advisories arrive after a build finishes.
- Rebuild on a schedule so base image fixes reach production.
Click through it at your own pace, or open it full screen.
Quick check
If I run SCA, do I still need an image scan?
Usually yes for containers, since the OS layer and anything added in the Dockerfile are outside your manifests.
Why rescan an image that passed last week?
New vulnerabilities are published against packages already inside it. The image did not change but the knowledge did.
Sources
Last reviewed: 19 October 2026.
