Container Scanning - Advanced Security Testing (HD)
Channel: GitLab
Date: 05/04/2023

Your application’s Docker image may itself be based on Docker images that contain known vulnerabilities. By including an extra Container Scanning job in your pipeline that scans for those vulnerabilities and displays them in a merge request, you can use GitLab to audit your Docker-based apps.

Container Scanning is often considered part of Software Composition Analysis (SCA). SCA can contain aspects of inspecting the items your code uses. These items typically include application and system dependencies that are almost always imported from external sources, rather than sourced from items you wrote yourself.

GitLab offers both Container Scanning and Dependency Scanning to ensure coverage for all of these dependency types. To cover as much of your risk area as possible, we encourage you to use all of our security scanners.

Read more in our docs: https://docs.gitlab.com/ee/user/application_security/container_scanning/