---
title: "Rescan the images that are running every · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/rescan-running-images
id: INF-84
level: Recommended
applies: servers
updated: 2026-10-27
build: a2a6bdfed830
tokens: 764
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Rescan the images that are running every day

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-84
- Level: Recommended
- Chapter: [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)
- Rule: Every day, scan each image that runs in production against the latest vulnerability data. Open a ticket for every new critical or high finding with a fix, and redeploy a fixed image within 7 days.
- Check: The daily scan report lists every digest that ran in production that day. No critical or high finding with a fix is older than 7 days without a ticket that names a reason.
- Applies when: The project runs its own servers, virtual machines or containers.
- How: A scan at build time says nothing about holes published the week after. List the image digests that run now from the cluster or the hosts, not from the registry, and scan each one. Most registries and scanners offer this, such as Amazon ECR enhanced scanning or a daily scheduled scan. The build-time scan stays, as [Scan every image before it ships](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/image-scanning.md) says. Rebuild from an updated base image and deploy it as usual.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Shell example

```sh
# Scan every image digest running in the cluster, once a day
kubectl get pods -A -o jsonpath='{range .items[*]}{.status.containerStatuses[*].imageID}{"\n"}{end}' \
  | tr ' ' '\n' | sed 's#^docker-pullable://##' | sort -u \
  | xargs -n1 trivy image --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1
```

## Sources

- [NIST SP 800-190 Application Container Security Guide](https://csrc.nist.gov/pubs/sp/800/190/final)

## Related rules

- ENG-70 [Scan every image before it ships](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/image-scanning.md) in Engineering

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/rescan-running-images">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Deploy only signed images from tags that cannot move](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/signed-immutable-images.md)
- [Containers and orchestration](https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration.md)