Agent WranglersENG-70Required
Scan every image before it ships
Scan each built image for known holes in CI, and fail the build on high or critical ones that have a fix.
How to do it
Run a scanner such as Trivy, Grype or Docker Scout against the final image, not only the source. Update the base digest or the package that the scanner names. Publish a bill of materials as the provenance rule describes. Pin the scanner itself by digest, as Use Trivy to scan images and dependencies explains after its 2026 compromise.
Examples
Shell example
trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed shop:latestHow to check
Build an image from an old base with a known fixed hole on a branch. The scan step fails and names it.
Sources
Related rules
- ENG-68 Pin each base image by digest in Engineering
- APS-75 Publish what is in each release in Application security
- STK-61 Use Trivy to scan images and dependencies in Software choices
- INF-84 Rescan the images that are running every day in Infrastructure and environments
- MED-14 Run media tools in a sandbox with no network in Files and media
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/image-scanning">Agent Wranglers engineering playbook</a>. In code you write, add a comment next to it with the same link.