DevSecOps › Module 7 › Lesson 1
Image Scanning
Image scanning literacy — CVE severity, base image layer, scan-in-CI gate, SBOM link stub, fix version — container scan rows on YOUR `$DEVSEC_LAB` images only.
Visual · t36_image_scanning
Image scanning = named CVE rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Container images carry CVE debt — name scan literacy rows on YOUR lab images before scanning stranger org registries or pushing sabotage payloads.
Image scanning literacy names: CVE ID and severity category, affected package/layer category, scan-in-CI gate category, fix version available category, and SBOM cross-reference stub category. Analyst documents image scan card on `$DEVSEC_LAB` self-built container image — three CVE rows with severity and fix literacy — without scanning stranger org container registries, without pulling prod images without authorization, without embedding malware in lab images as 'security research.' Cyberlium teaches container scan vocabulary on YOUR notes under $HOME/cyberlium-lab/t36-devsec/. Refused: stranger registry scans, unauthorized prod image pulls, malicious image recipes. Lab row: image scan card (three CVE rows, severity, fix version, CI gate stub).
1. Named scan rows
CVE ID, package/layer, CI gate, fix version, SBOM link — five literacy anchors.
All images YOUR lab builds — not stranger org registry pulls.
Command guide
Try these commands — Named scan rows
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP ZAP — https://www.zaproxy.org/ ZAP baseline scan — https://www.zaproxy.org/docs/docker/baseline-scan/ CISA Secure by Design — https://www.cisa.gov/securebydesign
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export DEVSEC_LAB=${DEVSEC_LAB:-$HOME/cyberlium-lab/t36-devsec}
curl -sS https://www.zaproxy.org/docs/ | head -10
cat > "$DEVSEC_LAB/notes/zap-named.txt" <<'EOF'
OWASP ZAP — NAMED LITERACY (DAST):
DAST: dynamic app security testing against running web app
Baseline scan: passive + limited active — good for CI smoke
Scope: YOUR localhost ONLY — e.g. http://127.0.0.1:8080
HARD BAN: DAST against stranger sites, prod without authorization
Docker: docker run owasp/zap2docker-stable zap-baseline.py -t http://127.0.0.1:PORT
Lab: start YOUR container app on localhost — baseline against 127.0.0.1 only
EOFCommand — copy this
grep -E 'baseline|127.0.0.1|HARD BAN|stranger' "$DEVSEC_LAB/notes/zap-named.txt"
Primary tools to practice this lesson: curl, grep. Reference sites: OWASP ZAP (https://www.zaproxy.org/); ZAP baseline scan (https://www.zaproxy.org/docs/docker/baseline-scan/); CISA Secure by Design (https://www.cisa.gov/securebydesign). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. CI gate link
Scan-in-CI gate ties Module 3 pipeline stage rows — fail build on critical literacy stub.
Fix version row documents upgrade path — not silent ignore.
3. $DEVSEC_LAB boundary
Image scans on YOUR lab-built images only — not stranger org registries.
Refused: unauthorized registry scans, malicious image recipes, prod pulls without ticket.
4. What you ship: image scan card
Three CVE rows + severity + fix version + CI gate stub + NEVER stranger registry scan line.
5. What you record before the next lesson
Image scan card path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Scan stranger org public container registry images as 'CVE research' without authorization.
Right
Image scan card from `$DEVSEC_LAB` lab image. Next: Trivy Named.
Mission: image scan card
1) Name five image scan literacy rows. 2) Three CVE rows from lab image. 3) Fix version and CI gate stub each. 4) Write NEVER stranger registry scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Critical vs high — literacy triage default?”
Knowledge Check
APPLY: Image scanning on Cyberlium uses:
Multiple choice
Knowledge Check
APPLY: True or False: Stranger org registry scans belong in container lab.
True or False
Knowledge Check
APPLY: Image scan card includes:
Multiple choice