---
title: "Scan every image before it ships · Agent Wranglers"
url: https://agentwranglers.se/playbook/operations/containers/image-scanning
updated: 2026-10-20
licence: "All rights reserved"
---

# Scan every image before it ships

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Containers](https://agentwranglers.se/playbook/operations/containers)
- Rule: Scan each built image for known holes in CI, and fail the build on high or critical ones that have a fix.
- How: Run a scanner such as Trivy, Grype or Docker Scout against the final image, not only the source. Update the base digest or the package that the scanner names. Publish a bill of materials as the [provenance rule](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/sbom-and-provenance) describes.
- Check: Build an image from an old base with a known fixed hole on a branch. The scan step fails and names it.

Example:

```sh
trivy image --exit-code 1 --severity HIGH,CRITICAL --ignore-unfixed shop:latest
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers operations playbook: https://agentwranglers.se/playbook/operations/containers/image-scanning`.

- Previous: [Declare a health check in the image](https://agentwranglers.se/playbook/operations/containers/container-health)
- Next: [Run one process per container](https://agentwranglers.se/playbook/operations/containers/one-process-per-container)
- [Containers](https://agentwranglers.se/playbook/operations/containers)