Cloud › Module 6 › Lesson 2
Image Scanning
Image scanning literacy — CVE severity, base image drift, scanner output triage — on `$CLOUD_LAB` local images only.
Visual · t31_image_scanning
Image scanning = named vulnerability triage rows. $CLOUD_LAB. Original Cyberlium.
Opening
Unscanned images ship known CVEs — name scanner output fields on YOUR lab images before trusting prod pulls.
Image scanning literacy names: scanner tool category (Trivy/Grype literacy stub), CVE ID and severity row, fixable vs accepted-risk category, base image update path, and scan-in-CI gate category. Analyst runs or reviews scan report on `$CLOUD_LAB` local image build — triages three findings with defender disposition (patch, rebuild, accept-with-note category) — without scanning stranger org images, without publishing scan dumps of prod assets without RoE, without ignoring critical CVE because 'lab only' without documentation. Cyberlium teaches triage vocabulary on YOUR docker build — not weaponized exploit chains from scan hits. Refused: unauthorized prod registry scan, exploit PoC from CVE output, hiding critical findings. Lab row: scan summary table (CVE, severity, disposition, UTC) for one lab image.
1. Scanner output fields
CVE ID, severity, package, fixed version, disposition — five literacy anchors.
Triage separates patch-now from document-accept — not blind ignore.
Command guide
Try these commands — Scanner output fields
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Trivy — https://aquasecurity.github.io/trivy/latest/ Trivy image scan — https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/
Optional command
Docker scan — https://docs.docker.com/engine/scan/
═══ INSTALL ═══
Linux (Debian/Ubuntu): Install from https://aquasecurity.github.io/trivy/
Command — copy this
sudo apt install docker.io # or Docker Engine docs sudo apt install curl
macOS:
Command — copy this
brew install trivy brew install --cask docker
Windows: Download Trivy releases / use WSL Install Docker Desktop Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export CLOUD_LAB=${CLOUD_LAB:-$HOME/cyberlium-lab/t31-cloud}
if command -v trivy >/dev/null; then
IMG=$(docker images -q | head -1)
if [ -n "$IMG" ]; then trivy image --severity HIGH,CRITICAL "$IMG" 2>/dev/null | head -20; else echo 'No local images — pull/build YOUR image first'; fi
else
curl -sS https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/ | head -10
cat > "$CLOUD_LAB/containers/trivy-missing-findings.md" <<'EOF'
# Trivy Not Installed — Markdown Findings Stub
- Tool: trivy image scan on YOUR local images
- Expected output: CVE list by severity
- Remediation: update base image, pin digest, rebuild
- Install: https://aquasecurity.github.io/trivy/latest/getting-started/installation/
EOFCommand — copy this
grep CVE "$CLOUD_LAB/containers/trivy-missing-findings.md" fi
Primary tools to practice this lesson: trivy, docker, curl. Reference sites: Trivy (https://aquasecurity.github.io/trivy/latest/); Trivy image scan (https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/); Docker scan (https://docs.docker.com/engine/scan/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender disposition
Patch/rebuild preferred on lab image; accept-with-note requires owner stub UTC.
Critical CVE on running lab container triggers rebuild row — hygiene link Module 6-1.
3. Refused
No unauthorized prod registry scan; no exploit PoC from scan output.
Scan literacy supports supply chain hygiene — not offensive chaining.
4. What you ship: image scan summary table
Three CVE rows + disposition each + NEVER exploit PoC from scan line.
5. What you record before the next lesson
Image scan summary table path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pull exploit PoC for critical CVE from scan as 'learning exercise' on employer network.
Right
Image scan summary from `$CLOUD_LAB` local image. Next: Escape Named Defense.
Mission: image scan summary table
1) Run or review scan on one lab image. 2) Three CVE rows with severity. 3) Disposition per row UTC. 4) Write NEVER exploit PoC from scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Accept-with-note — minimum fields?”
Knowledge Check
APPLY: Image scanning literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Exploit PoC from scan hits is course lab.
True or False
Knowledge Check
APPLY: Scan disposition should:
Multiple choice