Lion Cipher Lab

Scan a container image for vulnerabilities with Trivy

• Cloud Security
• Beginner
• ~50 min
• Free · no account required

Why it matters

Almost every modern app -- in the cloud and increasingly on your own machine -- ships as a CONTAINER IMAGE: a prepackaged bundle of an application plus all the operating-system pieces and libraries it needs to run. That convenience has a hidden cost: an image freezes in time whatever versions of those pieces it was built with, and software picks up publicly known security holes as time passes. Each of those known holes gets a public identifier called a CVE and a severity rating, and an image built six months ago can be quietly carrying dozens of them without anyone noticing. This is one of…

What you'll learn

• understanding what a container, a container image, and a 'layer' actually are, from zero
• understanding what a CVE, a vulnerability, and a severity rating (Low/Medium/High/Critical) mean
• installing Docker Desktop / Docker Engine on Windows, macOS, or Linux
• installing Trivy, the free open-source vulnerability scanner, on your own machine
• running your first scan of a public container image and making a real CVE report appear
• reading a Trivy CVE table: the CVE id, the affected package, the installed version, the FIXED version, and the severity
• filtering a report down to the findings that matter most (only HIGH and CRITICAL)
• understanding what an SBOM (software bill of materials) is and generating one for an image
• re-scanning an up-to-date image and comparing the counts to see that patching genuinely removes vulnerabilities
• doing all of this locally, on your own machine, against public images that are safe and legitimate to inspect

Steps in this lab

1. What this lab is, and why scanning public images is safe and legitimate
2. The words you need first: container, image, CVE, severity, scanner, SBOM (from zero)
3. Install Docker on your machine
4. Install Trivy (the free vulnerability scanner)
5. Run your first scan: point Trivy at an old public image
6. Read the CVE table: package, installed version, fixed version, severity
7. Focus the report: show only the findings that matter most
8. Bonus: list everything inside the image with an SBOM
9. Re-scan a patched image and compare the difference
10. Why this one skill makes you a defender, and where it goes next

Open the full interactive lab →