Modern image scanners (for example, Trivy, Grype, and similar tools) unpack every layer of a container image. They compare discovered libraries and packages against vulnerability databases and also run secret-detection rules that look for hard-coded API keys, tokens, or other credentials. They do not automatically sign, encrypt, or run the container; those actions require additional tooling.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What types of vulnerabilities can container scanning tools detect?
Open an interactive chat with Bash
What is a 'base layer' in the context of containers?
Open an interactive chat with Bash
How do scanners compare vulnerabilities against databases?