> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/container-and-artifact-security/image-scanning.md).

# Image Scanning

## Image Scanning

Container Image Scanning identifies vulnerabilities and security risks within container images **before they are deployed** to any environment. Container images commonly include operating system packages, third-party libraries, application code, and configuration — any one of which can harbor CVEs, misconfigurations, or embedded secrets.

OpsMx Delivery Shield integrates **Trivy** and **Grype** to scan every layer of every container image — providing comprehensive visibility into what is running inside each deployable unit.

## **Key Capabilities**

| Capability                        | Description                                                                                                                                |
| --------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ |
| **CVE Detection**                 | Known vulnerabilities in OS packages and application dependencies — matched against NVD, GitHub Advisories, and Linux Distribution notices |
| **Layer-by-Layer Scanning**       | Scans every layer of a container image — including base OS, installed packages, and application code                                       |
| **Secrets Detection**             | Identifies API keys, tokens, and passwords accidentally embedded in image layers                                                           |
| **Misconfiguration Detection**    | Flags images running as root, with excessive privileges, or with exposed ports                                                             |
| **SBOM Generation**               | Automatically generates a full SBOM per image in CycloneDX or SPDX format                                                                  |
| **Periodic Deployed Image Scans** | Trivy triggers recurring scans on already-deployed images as new CVEs are published — not just at build time                               |
| **Policy-Based Gating**           | High-severity findings automatically block image promotion via the Deployment Firewall                                                     |

## **Supported Registries**

Docker Hub · Amazon ECR · Google Container Registry · Google Artifact Registry · Azure Container Registry · JFrog Artifactory · GitLab Container Registry · Quay

## **Benefits for the User**

* Vulnerabilities are caught at the image layer — before they are deployed to any environment
* Continuously updated CVE data ensures newly published vulnerabilities surface on running workloads, not just at next build
* SBOM per image supports SEBI CSCRF, NIST 800-53, and supply chain compliance requirements automatically