A container image scanner should read both the operating system packages and the application dependencies inside the image, tell you which layer a flaw came from, and suggest a safer base image. Check registry and pipeline fit next, then how it handles noise.
What a good image scan covers
- OS packages such as those installed by the base image
- Application dependencies for each language in the image
- Layer attribution, so you know whether the fix is a base image change or an app change
- Image metadata, such as running as root or exposed ports, if the tool does configuration checks
Questions to ask
Where does it scan? In CI before push, in the registry after push, or at deploy time. Many teams need at least two, since new advisories arrive after an image is built.
Does it support your registries and formats? Check private registries, multi architecture images and your base distributions.
Does it handle distribution backports? Linux distributions often patch a flaw without changing the upstream version number. A scanner that compares only upstream versions will report false findings. Ask how it treats vendor advisory data.
Does it separate fixable from not fixable? Many OS findings have no fix yet. A filter for fix available keeps the list actionable.
Can it recommend a base image? Moving from a large general base to a smaller one often removes most findings in one change.
Simple steps that help whichever tool you pick
Use smaller base images, rebuild on a schedule so patched layers get picked up, and pin base images by digest while still updating that digest regularly.
When a free scan will do
For a few images and an occasional check, a command line scan is enough. Move to a managed option when you need history, policies in CI and reporting across teams.
A quick base image experiment
Scan one of your images, note the count, then rebuild it on a slimmer base and scan again. The difference shows how much of your risk is inherited from the base rather than from your own packages. It also shows you whether the scanner's layer attribution is clear enough to guide the choice. Run this experiment during a trial, since it tests two things at once.
Try it yourself
Click through it at your own pace, or open it full screen.
Look at how findings are grouped by layer.
Where Safeguard fits
Safeguard scans container images as part of its SBOM and dependency scanning. The free scan is a place to start with a repository.
Quick check
Do I need to scan images already in production?
Yes. Rescan them regularly, because new advisories apply to old images.
Last reviewed: 19 October 2026.
