Skip to content
AlertaVuln DocsAlertaVuln DocsAlertaVuln Docs

Container image scanning

Where dependency scanning tracks the packages your project declares, container scanning inspects a built image: the OS packages (deb / apk / rpm) and the application dependencies baked into its layers. AlertaVuln scans the image, normalises everything into one finding set tiered REDYELLOWGREEN, and lands the results on the project’s Containers page.

Scan where the image lives

Section titled “Scan where the image lives”

av image scan runs from your machine or CI runner, where the image is reachable:

  • The scanner is downloaded on first use, pinned to an exact version, and verified against a hard-coded SHA-256 checksum before it is installed.
  • Registry access uses your own Docker credentials from your local configuration. Those credentials never reach AlertaVuln.
  • The scan reads a live reference, a saved image tarball (--archive), or an existing CycloneDX SBOM (--sbom). Nothing about the image reaches AlertaVuln unless you opt in with --project, and then only the resulting findings and a CycloneDX inventory are uploaded.

The CLI reports the scanner by a neutral capability label, container-scanner, rather than a product name.

RED / YELLOW / GREEN tiering

Section titled “RED / YELLOW / GREEN tiering”

The scanner emits raw signals; the CLI tiers them for local display, and on upload the server computes the authoritative tier. A CVSS score wins when one is present; otherwise the scanner’s own severity class decides:

Signal Tier
CVSS score 7.0 and above RED
CVSS score 4.0 - 6.9 YELLOW
CVSS score below 4.0 GREEN
Severity critical or high, no CVSS RED
Severity medium, no CVSS YELLOW
Severity low or unknown, no CVSS GREEN

Base image vs your layers

Section titled “Base image vs your layers”

Every finding is attributed to the layer that introduced it, so the Containers page splits findings into base image layers and your layers. That split tells you at a glance which vulnerabilities you fix by changing your base image versus by changing what your own build adds.

Base image advice

Section titled “Base image advice”

For each image, AlertaVuln suggests up to three safer base images - a newer patch tag, a slimmer variant, or the next major - each with a concrete tiered delta such as “-2 RED, -14 YELLOW”, plus the Dockerfile FROM line to change when the project has a connected repo. See base image advice.

Continuous monitoring (Enterprise)

Section titled “Continuous monitoring (Enterprise)”

Turn on monitoring for an image and AlertaVuln keeps re-checking it as new CVEs land - a nightly sweep plus an event-driven re-match whenever a fresh CVE names a package in the image - all from the stored inventory, with no image re-pull. New or reopened findings raise alerts through your configured channels. See continuous monitoring.

Reference

Section titled “Reference”
av image scanScan an image, tier findings, and optionally upload to a project.
av image findingsList the consolidated container findings the server holds for a project.
av image listList a project's scanned images with their RED / YELLOW / GREEN counts.
Base image adviceSafer base images with concrete vulnerability deltas.
Continuous monitoringRe-check stored images as new CVEs land - Enterprise.
Workload Identity for ACRConnect a private Azure Container Registry to AV-hosted scanning with no stored secret.

See also

Section titled “See also”