Container scan

Check how an image is built — before it is the thing running in production.

Container scanning resolves an image, reads its layers and configuration, and reports how it was built. It works against a registry reference or a local OCI tarball, so it fits both a CI step that has just built an image and an audit of something already published.

Run it

Against a registry:

$ sentrasec container alpine:3.19$ sentrasec container ghcr.io/library/redis:7

Against a tarball you just built, with no registry involved:

$ docker save my-app:ci -o my-app.tar$ sentrasec container my-app.tar

A real run against a public base image:

output

Container scan: 1 misconfig finding(s) — hygiene score 90/100  [High] image `alpine:3.19` runs as root; add a `USER <non-root>` directivesentrasec: container target=alpine:3.19 findings=1 score=90 exit=0

What it checks

Build-time posture read from the image itself: whether it runs as root, whether the tag is pinned or floating, and the layer and base-image hygiene that rolls up into the score. The hygiene score is a 0–100 summary of that posture — useful as a trend line across builds rather than as an absolute grade.

This is a build-configuration check, not a package-vulnerability report. CVE matching against the packages inside an image depends on graph enrichment, which is currently disabled — see Run a scan. Treat a clean container scan as “well built”, not as “no known vulnerabilities”.

Output formats

$ sentrasec container my-app.tar --format json$ sentrasec container my-app.tar --format sarif

SARIF publishes into GitHub code scanning, so an image built in CI annotates the pull request that changed its Dockerfile.

Pair it with the Dockerfile scan

The two catch different things and are worth running together. IaC reads the Dockerfile in the repository and can tell you which line to change; container scanning reads the built artifact and catches what the base image contributed, which no amount of reading your own Dockerfile will reveal.

$ sentrasec iac .$ sentrasec container my-app.tar

Through the API

To record results against a registered app so they appear in the console with history:

$ sentrasec scan --kind container --app-id app_...