Security scanning

What is container scanning?

Inspecting container images for vulnerable OS packages, application dependencies and unsafe build practices.

By Cláudia FernandesUpdated 2026-10-02

A container image bundles a base OS layer, system packages and your application. Scanning walks each layer and reports known vulnerabilities, which most often live in the base image rather than anything your team wrote.

The practical output is usually a base-image upgrade recommendation. Tools differ in whether they can tell you which findings come from a layer you control versus one you inherited, a distinction that decides whether the report is actionable.

What to look for

Whether findings are attributed to the layer that introduced them
Registry integration for scanning images already deployed
Base image upgrade recommendations rather than raw CVE lists
Whether the scan runs in CI before push, or only on stored images

Best 12 container scanning tools

Every tool in the directory whose documentation covers this, 6 fully and 6 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.

Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.

Code Security Platform

Aikido

15+ registries; base image vulns, layer secrets, malicious packages, misconfigurations

Code Security Platform

Checkmarx One

Dedicated Container Security scanner for Dockerfiles and named images, plus private registry auth for DockerHub, ECR, GCR, GAR.

Code Quality Platform

Codacy

Container image scanning included; Business plan only, scanner and scope not named.

Code Security Platform

Corgea

Base-image/OS/library CVEs across 7 named registries

Code Security Platform

Snyk

Scans final image OS and app packages; base image upgrade advice; automatic Dockerfile fix PRs.

Code Security Platform

Veracode

Container image/archive scanning across nine base OS families for vulns, misconfigurations, secrets

PR Review Tool

CodeAnt AI

Dockerfile configuration checks and Kubernetes/Helm deployment validation; no container image vulnerability scanning

PR Review Tool

CodeRabbit

Trivy and Hadolint cover Dockerfiles in-repo; no container registry or image scanning described

Code Quality Platform

DeepSource

Dockerfile analyzer flags root user, latest tags, missing health checks, exposed ports; no image or layer scanning.

Code Security Platform

GitHub Advanced Security

Dependabot supports the docker ecosystem for updates; no container image vulnerability scanning documented

Code Quality Platform

Qlty

Dockerfile linting via Hadolint and Trivy misconfiguration checks; no container image vulnerability scanning

Code Quality Platform

SonarQube

Dockerfile analysis only; no container image or layer scanning documented.

SAST Taint Analysis (Data-Flow)Secrets Detection Secrets Validation SCA Reachability Analysis

FAQ