Safety & Security · Software component
Container Image Scanner
Software componentSafety & SecuritySafety, Security & Governancearc:ContainerVulnerabilityScanner
A security component that inspects built container images for known vulnerabilities in base images and dependencies and fails the build on critical CVEs.
Responsibility. Blocks vulnerable images from being published or deployed.
Also known as: Vulnerability scanner, Image security scan, Infrastructure security scanner
Relationships
is configured by structural
is invoked by dependency
reads dependency
triggers dynamic
guards control
audits assurance
evaluates assurance
Design guidance
- MUST fail builds containing critical CVEs until dependencies are upgraded to patched versions.
- MUST scan every built image immediately after build, since source scanners miss OS-package and transitive-dependency vulnerabilities.
- SHOULD run in CI/CD to flag outdated runtime versions and base images with disclosed CVEs.
- SHOULD scan infrastructure for misconfigurations as well as vulnerabilities and alert immediately on critical findings.
Classification
- Patterns
- Shift-left securitySeverity-threshold build gate
- Technologies
- TrivySARIFGitHub Security tabSnykKubernetes security scan
- Quality attributes
- Security (ISO/IEC 25010 | NIST AI RMF: secure and resilient)
- Risks mitigated
- Deploying images with known critical CVEsDeploying images with known exploitable vulnerabilitiesDependency vulnerabilities missed by source-code scanning
Sources
- Ch4.1: T. Nguyen, "Introduction to AI Agent Deployment and Scaling," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 4.1. ISBN: 9798244538229.
- Ch4.2: T. Nguyen, "Deployment and Scaling," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 4.2. ISBN: 9798244538229.
- Ch9.3: T. Nguyen, "Sandboxing and Transparency Foundations," in Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam, 1st ed. 2026, ch. 9.3. ISBN: 9798244538229.
- Ref9.09: "Compliance Automation and Tools," unpublished reference note (09-Compliance-Automation-Tools.md), Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam supplementary materials, 2026. unpublished note
- Ref9.10: "Chapter 9 Summary: Safety, Ethics, and Compliance," unpublished reference note (10-Chapter-9-Summary.md), Mastering Agentic AI Systems: Guide for the NVIDIA NCP-AAI Exam supplementary materials, 2026. unpublished note