Production Security
Docker Image Vulnerability Triage Guide
Triage container image findings by proving package reachability, base-image ownership, available fixes and deployment exposure. This reference is written for developers who need practical validation behavior, reviewable rules and safe examples rather than copied snippets with no explanation.
Recommended workflow
| Step | Why it matters |
|---|---|
| Pin the artifact | Record the immutable image digest and scanner database time. |
| Identify package origin | Separate operating-system packages, language dependencies and copied binaries. |
| Assess practical exposure | Check whether the affected component is loaded, reachable and enabled in the deployed runtime. |
| Rebuild and verify | Update the smallest owning layer, rebuild from clean inputs and scan the resulting digest. |
Starter snippet
scanner result -> package origin -> reachable use -> fixed version -> rebuilt digestReview checks
- Prefer maintained minimal base images.
- Generate an SBOM during the build.
- Track accepted risk with owner and expiry.
- Redeploy by digest after remediation.
Common mistakes
- Ignoring every finding marked unfixed.
- Patching a running container instead of its build source.
- Comparing scans from different database dates without noting it.
Validation should help users correct input while protecting systems from bad data. Keep syntax checks, product policy, security review and deliverability checks separate.
Related Formalint references
Continue with Dependency Vulnerability Triage Guide, Docker Build Cache Debugging Guide, Secrets Redaction Checklist.