Container Scanning: Run Fast and Stay Safe

The talk starts from a common gap: Kubernetes and Docker keep workloads running but do little to protect the software packaged inside each container. The presenter argues that containers are short-lived, identical each time they start, and rarely change in place, so a container's installed software can be inventoried once and checked against a vulnerability database. Container scanning is presented as one input alongside unit tests, static analysis and license checks, feeding a go or no-go decision mapped to organizational policy.

The middle of the talk covers when to scan. Options include the build pipeline, the container registry, Kubernetes validating admission webhooks at pod launch, and running clusters. A new image can take around ten minutes to inventory, while a result cached by image hash returns almost immediately. The presenter demonstrates Anchore, an open-source scanner that runs as microservices, through its command-line tool and a GitHub Actions workflow. The demo covers building a package inventory with licenses, comparing it to vulnerability feeds, and applying a policy that fails the build. Limitations were noted: feed downloads can be slow, and the scanner reads package manifests rather than every file on disk.

The closing section stresses that the failure threshold is an organizational decision. Teams must decide how much risk to tolerate when no fix exists and whether a vulnerable service should be blocked or kept running. Suggested practices include rebuilding images on a schedule, letting operations trigger rebuilds without developer involvement, and running tests in multi-stage Dockerfiles so that failing tests stop an image before it reaches the registry.