Sachin Chaurasiya
Search articles, labs, tools…

Path 02 · learning path

Container Security

From Dockerfile to registry: scanning images, producing SBOMs, reducing the attack surface and keeping the results actionable.

Parts
2 parts
Total reading time
~21 min to read
Difficulty
beginner
Start with part 1 See the path ↓

What you will learn

  • Read a Trivy report, tune severity and fix filters, and gate a pipeline without drowning in findings
  • Cache the vulnerability database in CI and re-scan what is already running
  • Turn a 994 MB single-stage image into a 7.7 MB distroless image that runs as a non-root user
  • Choose the runtime base that matches what the binary actually links

Before you start

Knowledge assumed

  • Building and running containers with Docker
  • Reading a Dockerfile

Hands-on environment

  • Docker with BuildKit
  • A container registry you can push to
  • Trivy, installed or run from its image

Each part names what it needs. Nothing has to be installed before part 1.

The path

2 parts, in order

Each part states what it assumes from the previous one, so you can also jump in where your setup already is.

  1. Part 1 of 2 Start here

    Container Image Scanning with Trivy

    How Trivy finds OS and application vulnerabilities, secrets and misconfigurations in container images, how to make the results actionable, and how to wire it into CI without slowing builds down.

    Security Tools beginner 9 min read
  2. Part 2 of 2

    Building Minimal Container Images with Multi-Stage Builds

    Build the same Go service as a single-stage image and as a multi-stage image on a distroless base, then compare size, package count, scanner findings and the user it runs as.

    Docker beginner 12 min read

Practise

Labs that exercise this path

All labs →
Lab

Secure Docker Images with Trivy

Build a deliberately weak image, scan it with Trivy, and rebuild it until the gate for fixable HIGH and CRITICAL findings passes: current base, non-root user, patched packages, no pip in the runtime image.

beginner 30 minutes Trivy · Docker
Lab

Generate an SBOM with Syft and Scan It with Grype

Produce CycloneDX and SPDX bills of materials for a container image without a Docker socket, scan the SBOM with Grype, gate on fixable findings only, and see why the SBOM is worth keeping after the release.

intermediate 35 minutes Syft · Grype · Docker

Toolchain

Tool profiles used in this path

All tools →
secure Vulnerability & misconfiguration scanner

Trivy

All-in-one scanner for container images, filesystems, IaC, Kubernetes and SBOMs.

package Container build & runtime

Docker

Container build and runtime tooling; the default way to package applications as OCI images.

After the last part

Where to go next

One path picks up where this one stops. It is a suggestion, not a requirement.