Container Image Scanning
Scan a container image for OS and dependency vulnerabilities with Trivy, generate an SBOM, sign the image with cosign, and enforce all three as a CI gate before an image is allowed to be pushed to a registry.
Prerequisites: Docker installed and running, Trivy CLI installed, cosign CLI installed, and a container registry you can push to (Docker Hub or GitHub Container Registry both work).
A container image is a black box of transitive dependencies unless you actively inspect it — the base OS packages, language runtime, and every layer added by every FROM and RUN instruction in the Dockerfile all carry their own vulnerability surface, most of which was never a decision anyone on your team consciously made. Image scanning turns that black box into an inspectable, gate-able artifact.
This project covers the three pillars of container supply-chain security that show up in almost every real DevSecOps pipeline: vulnerability scanning (what's wrong with this image), SBOM generation (what's actually in this image, full stop), and signing (proof this image came from your pipeline and hasn't been tampered with since). Each is a separate concern and a separate tool, but they compose into a single gate.
Test what you just learned
Self-testing is one of the best ways to retain new skills. Unlock project quizzes to check your understanding.
Log in to unlock0 / 6 complete