Skip to content
AlertaVuln DocsAlertaVuln DocsAlertaVuln Docs

Base image advice

For a scanned image, AlertaVuln suggests up to three safer base images, each with the concrete RED / YELLOW / GREEN delta it would bring. The advice surfaces on the project’s Containers page and through the get_base_image_advice MCP tool.

How the base image is found

Section titled “How the base image is found”

The advisor identifies the current base image, best-effort, in priority order:

  1. the OCI annotation org.opencontainers.image.base.name when the image builder recorded it;
  2. heuristics over the image config history;
  3. the connected repository’s Dockerfile FROM line, when the project has a connected repo (read through the git provider - the repo is never cloned).

What it recommends

Section titled “What it recommends”

Within the same base-image family, the advisor enumerates candidates from the public registry and categorises each suggestion:

  • Minor upgrade - a newer patch or point tag of the same major.minor.
  • Variant switch - a slimmer or minimal variant (for example a -slim, -alpine, or distroless equivalent).
  • Major upgrade - the next major version.

Each candidate is scored by scanning it and comparing tiered counts against your current base, expressed as a delta such as “-2 RED, -14 YELLOW”. A negative delta means fewer vulnerabilities. When the project has a connected repo, the advice also names the Dockerfile path and the FROM line to change.

Scoring is cached by base-image digest and shared across customers, so popular bases are effectively pre-computed. While a candidate is still being scored it is shown as Pending (no delta yet) and settles to Scored once its scan completes.

Best-effort by design

Section titled “Best-effort by design”

Advice never blocks or delays finding ingestion - if the advisor has nothing to offer (for example a private base image it cannot enumerate), it degrades to “no advice available” and the rest of the scan is unaffected.

See also

Section titled “See also”