PRIMATE TRACE
EN / TH
Sign Up
Home
Products
WebAppAPICloud ContainerNetwork Device HostDatabase
Solutions
Risk TriageCVSS Scoring
Company
AboutContact
EN TH
Login
Sign Up
Back to attack surfaces
Infrastructure

Container image scanning

Know what's inside every image before it ships to production.

Why scan this?

A container image is really a stack of someone else's software: the base OS, language runtime, and every package layered on top. Any one of them can carry a known CVE, and once that image is running in production, the vulnerability ships with it to every replica. This scan inspects an image's full layer history and package list against live vulnerability databases before, or right after, it reaches your registry.

What you get from this scan

  • A full software bill of materials (SBOM) listing every package and version inside the image
  • CVSS-scored CVEs mapped to the exact package and layer that introduced them
  • A clear split between base-image issues and issues from your own added layers
  • Fix guidance showing the package version that resolves each CVE
  • A report you can gate a CI/CD pipeline on before deploying to production

How this scan stays safe for your systems

  • The scan inspects the image's metadata and filesystem layers; it never runs the container
  • Only the image reference you provide (for example a Docker Hub tag) is pulled and analyzed
  • No outbound network access is granted to the image during analysis
  • Results are scoped to your workspace and never shared with the image's public registry
  • Only scan images you own, built yourself, or have explicit permission to inspect

What we check

Known CVEs in OS packagesKnown CVEs in application dependenciesOutdated base imagesExposed secrets baked into layersContainers running as rootMissing image signing

Container image scanning

Free to try. See real, CVSS-scored results in minutes.

Start scanning