Container images are scanned by a single engine (Trivy). One scan runs up to three passes against an image — vulnerabilities, secrets, and misconfiguration — and generates a Software Bill of Materials. The passes merge into one per-image findings list.
What runs against each image
Each pass is toggled by the org’s container-scan settings. When none of the first three are enabled, the worker falls back to enabling all of them.
| Pass | Config flag | What it does |
|---|
| Vulnerabilities | enable_vulnerability_scan | OS-package and language-dependency CVEs |
| Secrets | enable_secrets_scan | Hardcoded secrets and credentials embedded in image layers |
| Misconfiguration | enable_misconfig_scan | Dockerfile / image-config checks |
| SBOM | generate_sbom | Software Bill of Materials in SPDX JSON |
An enable_malware_scan flag exists in the scan config, but no malware engine is currently wired to it — enabling it has no effect. The scanner does not run a signature or heuristic malware scan.
What gets scanned
The engine scans the entire image — every layer — for the enabled passes. There is no per-layer opt-in; the vulnerability, secret, and misconfiguration passes each cover the whole image.
Results are recorded per image, keyed on (organization, repository, tag). Re-scanning the same repository:tag updates that image’s latest counts and findings rather than creating a duplicate image record; each scan also appends a history row so past scans remain visible.
Vulnerability detection
CVEs come from Trivy’s built-in vulnerability database, which aggregates upstream feeds including NVD, the GitHub Advisory Database, OSV, and per-distro security trackers (Ubuntu, Debian, Red Hat, Alpine, SUSE).
Each vulnerability finding includes:
- CVE ID and CVSS v3 score
- Affected package and installed version
- Fix version, when a fixed release exists (surfaced as an “Upgrade …” remediation)
- Target (the OS package set or the lockfile/manifest the package came from)
Findings are additionally mapped to OWASP Top 10 2021 categories and, where Trivy supplies them, CWE identifiers.
Misconfiguration checks
Misconfiguration findings come from Trivy’s config scanner applied to the image and its build configuration (for example, a container running as root or a missing HEALTHCHECK). Each finding carries a title, description, severity, and a resolution string used as the remediation.
SBOM output
Every scan that has generate_sbom enabled produces a Software Bill of Materials in SPDX JSON. The SBOM records each component’s name, version, and concluded license.
SBOM components are available from the dashboard (Container Security → Images → <image> → SBOM) and from the API:
GET /api/container-security/images/{imageId}/sbom
Image-level summary
Each scanned image record carries:
- CVE counts by severity — critical / high / medium / low, plus a total
- Fixable count — vulnerabilities that have a fix version
- Secrets detected flag
- Package count — number of components in the SBOM
- OS distribution and architecture — as reported by Trivy
- Scan duration
A single image scan is bounded by a 15-minute timeout (SBOM generation has its own 5-minute timeout). Typical scan time scales with image size:
| Image size | Typical scan time |
|---|
| < 200 MB | 30–90s |
| 200 MB – 1 GB | 1–3m |
| 1 GB – 5 GB | 3–10m |
| > 5 GB | 10–30m |
apt caches, entire node_modules copied into the final layer) take longer to pull and scan. 
