Scan both. A Dockerfile scan reads the build instructions and catches risky habits such as running as root or baking secrets into layers. An image scan reads the finished contents and finds vulnerable packages. Neither can see what the other sees.
What each one sees
| Check | Dockerfile scan | Image scan |
|---|---|---|
| Runs as root | Yes | Sometimes, from image config |
| Secret passed as build argument or env | Yes | Yes, in layers and metadata |
| Vulnerable OS package | No, only the base name | Yes |
| Vulnerable app dependency | No | Yes, if the manifest or lockfile is in the image |
| Unpinned base tag | Yes | No |
| Files left in a layer | No | Yes |
Why layers matter
Docker describes an image as a stack of immutable layers, each recording filesystem changes such as additions, deletions or modifications. Because earlier layers cannot be changed, deleting a file in a later step marks it removed in the stack, but the earlier layer still holds it. This is an inference from immutability rather than a quote, and it is why a secret removed by a later step can still be found in the image.
Secrets in builds
Docker's documentation says build arguments and environment variables persist in the final image, so anyone with the image can read them. Secret mounts expose the value only while a single build step runs:
RUN --mount=type=secret,id=aws AWS_SHARED_CREDENTIALS_FILE=/run/secrets/aws aws s3 cp ...
A Dockerfile scan can flag the unsafe pattern. An image scan can confirm nothing leaked.
Steps
- Lint the Dockerfile in the pull request.
- Build the image in CI.
- Scan the built image before it is pushed.
- Scan again on a schedule, since new advisories appear after you ship.
- Rebuild from a patched base when the base image is the source of findings.
How Safeguard helps
Safeguard covers SBOM and dependency scanning, reachability analysis, and policies and gates that apply in pull requests. The free scan is a quick way to see your dependency findings.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at which findings come from the base layer and which from the application layer.
Quick check
Can an image scan replace Dockerfile review?
No. It sees contents, not intent. Build habits like unpinned tags are only visible in the Dockerfile.
Is a secret deleted in a later step gone from the image?
Not necessarily. The earlier layer is immutable and may still contain it.
Sources
- Docker documentation, Understanding image layers (fetched 19 October 2026).
- Docker documentation, Build secrets (fetched 19 October 2026).
Last reviewed: 19 October 2026.
