How do you scan Docker images for known vulnerabilities?
Use a scanner such as Trivy, Grype or Docker Scout to compare packages in the image against CVE databases. Run it in CI, fail builds on high severity issues, and rebuild regularly on updated base images.
Explain it simply
Like a medical check-up before boarding: the scanner lists what is inside your image and checks it against a database of known problems (CVEs).
trivy image myapp:1.0 reads the OS packages and language dependencies, such as pip or npm packages, and prints findings with severity from LOW to CRITICAL and the version that fixes each. Put it in your CI pipeline with --exit-code 1 --severity HIGH,CRITICAL so a risky image never reaches the registry. Registries like ECR and Docker Hub can also scan on push.
Findings change daily as new CVEs are published, so an image that was clean last month may not be today. Rebuild on fresh base images regularly, use small bases to reduce what can be flagged, and treat unfixable or unreachable findings with a documented exception rather than ignoring the scan.
Example
trivy image myapp:1.0
trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:1.0
docker scout cves myapp:1.0What to say in the interview
"I scan with Trivy, Grype or Docker Scout, ideally in CI with a failing threshold for high and critical issues. Because new CVEs appear constantly, I rebuild on updated small base images and rescan regularly."
Common mistakes
- Scanning once at release and never again.