Shifting Container Security Left
Container images are built in layers, each potentially introducing vulnerabilities. Scanning images before deployment catches issues early, but security must extend through the entire container lifecycle.
Scanning Phases
Build-Time Scanning
Scan images during CI/CD:# GitHub Actions example
- name: Scan container image
uses: aquasecurity/trivy-action@master
with:
image-ref: myapp:${{ github.sha }}
severity: 'CRITICAL,HIGH'
exit-code: '1' # Fail build on findings
Registry Scanning
Continuously scan images stored in registries:- Detect new CVEs in existing images
- Flag images that haven't been rebuilt recently
- Enforce policies (no root, no shell, etc.)
Runtime Scanning
Monitor running containers for:- Drift from the original image
- New processes or network connections
- File system modifications
- Privilege escalation attempts
Best Practices
1. Minimal Base Images
# BAD: Full OS image (hundreds of vulnerabilities)
FROM ubuntu:22.04
# GOOD: Minimal image (few or zero vulnerabilities)
FROM gcr.io/distroless/python3-debian12
2. Multi-Stage Builds
# Build stage (includes build tools)
FROM node:20 AS builder
WORKDIR /app
COPY . .
RUN npm ci && npm run build
# Production stage (minimal runtime)
FROM node:20-slim
COPY --from=builder /app/dist /app
CMD ["node", "/app/server.js"]
3. Pin Versions
# BAD: Mutable tag
FROM node:latest
# GOOD: Specific digest
FROM node:20.11@sha256:abc123...
4. Non-Root Execution
RUN addgroup --system app && adduser --system --ingroup app app
USER app
Where SuperClue Fits
SuperClue does not scan container images. Its SOC agent can run as a Docker container or a Kubernetes DaemonSet to monitor the hosts your images run on.