Container image scanning is software that inspects a container image, the packaged file that an app is shipped in, and reports every known security flaw inside it. Some tools also remove the parts of the image that the app never uses, and the flaws in those parts are removed with them.
First, what is inside an image? A container is a packaged piece of an app that runs in the same way on any server. The image is the file from which the container is started. It holds the app's code, the libraries that the code needs, and a small copy of an operating system, usually Linux, with its own programs. Developers rarely build that operating-system layer themselves. They start from a ready-made base image, downloaded from a public website.
Consider a logistics company in Chennai that ships its parcel-tracking service as a container. Its developers started from a full Linux base image. The finished image is 1.1 GB and holds about 600 software packages. The scanner opens the image layer by layer and lists every package with its version. It matches the list against the public catalogue of known flaws, the CVE list. It reports 210 known flaws, and 12 of them are critical. But the tracking service uses only about 70 of the 600 packages. Most of the flaws are in programs that it never runs, such as tools for editing files.
A hardening tool then builds a smaller image that holds only the packages the service uses. The new image is 140 MB and has 9 known flaws, none of them critical. Removing a package is safer than patching it, because a program that is not there cannot be attacked.
Scanning happens at three points. The CI/CD pipeline scans each new image when it is built. The artifact registry, where built images are stored, scans them again whenever a new flaw is published. And the Kubernetes platform can be set to refuse to start any image that has not passed a scan.
Image scanning overlaps with software composition analysis (SCA), since both list libraries and match them against known flaws. SCA reads the app's own lists of libraries. Image scanning reads everything in the finished package, including the operating system. Once the container is running, it is watched by cloud workload protection (CWPP). So image scanning checks the package before it runs, and workload protection watches what the program does while it runs.