Agent Wranglers

INF-84Recommended

Rescan the images that are running every day

Every day, scan each image that runs in production against the latest vulnerability data. Open a ticket for every new critical or high finding with a fix, and redeploy a fixed image within 7 days.

By Agent Wranglers. Updated .

How to do it

A scan at build time says nothing about holes published the week after. List the image digests that run now from the cluster or the hosts, not from the registry, and scan each one. Most registries and scanners offer this, such as Amazon ECR enhanced scanning or a daily scheduled scan. The build-time scan stays, as Scan every image before it ships says. Rebuild from an updated base image and deploy it as usual.

Examples

Shell example

# Scan every image digest running in the cluster, once a day
kubectl get pods -A -o jsonpath='{range .items[*]}{.status.containerStatuses[*].imageID}{"\n"}{end}' \
  | tr ' ' '\n' | sed 's#^docker-pullable://##' | sort -u \
  | xargs -n1 trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1

How to check

The daily scan report lists every digest that ran in production that day. No critical or high finding with a fix is older than 7 days without a ticket that names a reason.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/rescan-running-images">Agent Wranglers infrastructure and environments playbook</a>. In code you write, add a comment next to it with the same link.