Agent Wranglers

Containers Required

Scan every image before it ships

Scan each built image for known holes in CI, and fail the build on high or critical ones that have a fix.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Run a scanner such as Trivy, Grype or Docker Scout against the final image, not only the source. Update the base digest or the package that the scanner names. Publish a bill of materials as the provenance rule describes.

Example

trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed shop:latest

How to check

Build an image from an old base with a known fixed hole on a branch. The scan step fails and names it.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/containers/image-scanning.