Image Scanning
Image scanning literacy — CVE severity, base image layer, scan-in-CI gate, SBOM link stub, fix version — container scan rows on YOUR `$DEVSEC_LAB` images only.
Visual · t36_image_scanning
Image scanning = named CVE rows. $DEVSEC_LAB. Original Cyberlium.
Container images carry CVE debt — name scan literacy rows on YOUR lab images before scanning stranger org registries or pushing sabotage payloads.
Image scanning literacy names: CVE ID and severity category, affected package/layer category, scan-in-CI gate category, fix version available category, and SBOM cross-reference stub category. Analyst documents image scan card on `$DEVSEC_LAB` self-built container image — three CVE rows with severity and fix literacy — without scanning stranger org container registries, without pulling prod images without authorization, without embedding malware in lab images as 'security research.' Cyberlium teaches container scan vocabulary on YOUR notes under $HOME/cyberlium-lab/t36-devsec/. Refused: stranger registry scans, unauthorized prod image pulls, malicious image recipes. Lab row: image scan card (three CVE rows, severity, fix version, CI gate stub).
1. Named scan rows
CVE ID, package/layer, CI gate, fix version, SBOM link — five literacy anchors.
All images YOUR lab builds — not stranger org registry pulls.
Command guide
Try these commands — Named scan rows
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: curl, grep. Reference sites: OWASP ZAP (https://www.zaproxy.org/); ZAP baseline scan (https://www.zaproxy.org/docs/docker/baseline-scan/); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. CI gate link
Scan-in-CI gate ties Module 3 pipeline stage rows — fail build on critical literacy stub.
Fix version row documents upgrade path — not silent ignore.
3. $DEVSEC_LAB boundary
Image scans on YOUR lab-built images only — not stranger org registries.
Refused: unauthorized registry scans, malicious image recipes, prod pulls without ticket.
4. What you ship: image scan card
Three CVE rows + severity + fix version + CI gate stub + NEVER stranger registry scan line.
5. What you record before the next lesson
Image scan card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
- Wrong: Scan stranger org public container registry images as 'CVE research' without authorization.
- Right: Image scan card from `$DEVSEC_LAB` lab image. Next: Trivy Named.
Mission: image scan card
1) Name five image scan literacy rows. 2) Three CVE rows from lab image. 3) Fix version and CI gate stub each. 4) Write NEVER stranger registry scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Critical vs high — literacy triage default?”
APPLY: Image scanning on Cyberlium uses:
APPLY: True or False: Stranger org registry scans belong in container lab.
APPLY: Image scan card includes: