Image Size + Scanning — Two Levers, Same Goal

~14 min · security, size

Level 0Container Curious

0 XP0/36 lessons0/10 achievements

0/120 XP to next level120 XP to go0% complete

Smaller images are more secure (most of the time)

Less surface area = fewer libraries = fewer CVEs. Slim/distroless/scratch all carry less risk than a full Debian or Ubuntu image. Size is also faster to pull, cheaper to store, and faster to scan.

Scan in CI, fail on critical CVEs

Docker Scout ships with Docker Desktop. Trivy is a popular open-source alternative. Both scan an image for known CVEs in OS packages and language-level dependencies. Run them in your build pipeline and fail the build on Critical/High findings.

Code

Optimize image size·bash

# Compare
docker images myapp --format 'table {{.Repository}}:{{.Tag}}\t{{.Size}}'

# Inspect the layers (where bloat hides)
docker history myapp:1.0

# Common wins:
#  - Multi-stage builds (we covered)
#  - .dockerignore (we covered)
#  - Slim/distroless base
#  - Combine RUN apt-get update && apt-get install -y ...
#    && rm -rf /var/lib/apt/lists/* in ONE layer

Scan with Docker Scout and Trivy·bash

# Docker Scout (built into Docker Desktop)
docker scout quickview myapp:1.0
docker scout cves myapp:1.0
docker scout recommendations myapp:1.0

# Trivy (works without Docker Desktop)
docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image myapp:1.0

# In CI: fail on HIGH or CRITICAL
docker run --rm \
  -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image --exit-code 1 --severity HIGH,CRITICAL myapp:1.0

External links

Exercise

Pick one of your images. Run docker scout quickview or Trivy on it. Note the count of CVEs by severity. Apply two optimizations (multi-stage, slim base) and rescan. Did Critical/High counts drop?

Progress

Progress is local-only — sign in to sync across devices.

← PreviousSecrets — Don't Bake, Don't Commit 🔍 Debugging Containers — Read the Exit Code →The 'Why Won't It Start?' Checklist

Spotted a bug or have feedback on this page?Report an Issue

Comments 0

🔔 Reply notifications (sign in)

No comments yet — be the first.