Cloud › Module 6 › Lesson 2
Image Scanning
Image scanning literacy — CVE severity, base image drift, scanner output triage — on `$CLOUD_LAB` local images only.
Visual · t31_image_scanning
Image scanning = named vulnerability triage rows. $CLOUD_LAB. Original Cyberlium.
Opening
Unscanned images ship known CVEs — name scanner output fields on YOUR lab images before trusting prod pulls.
Image scanning literacy names: scanner tool category (Trivy/Grype literacy stub), CVE ID and severity row, fixable vs accepted-risk category, base image update path, and scan-in-CI gate category. Analyst runs or reviews scan report on `$CLOUD_LAB` local image build — triages three findings with defender disposition (patch, rebuild, accept-with-note category) — without scanning stranger org images, without publishing scan dumps of prod assets without RoE, without ignoring critical CVE because 'lab only' without documentation. Cyberlium teaches triage vocabulary on YOUR docker build — not weaponized exploit chains from scan hits. Refused: unauthorized prod registry scan, exploit PoC from CVE output, hiding critical findings. Lab row: scan summary table (CVE, severity, disposition, UTC) for one lab image.
1. Scanner output fields
CVE ID, severity, package, fixed version, disposition — five literacy anchors.
Triage separates patch-now from document-accept — not blind ignore.
Command guide
Try these commands — Scanner output fields
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: trivy, docker, curl. Reference sites: Trivy (https://aquasecurity.github.io/trivy/latest/); Trivy image scan (https://aquasecurity.github.io/trivy/latest/docs/scanner/vulnerability/); Docker scan (https://docs.docker.com/engine/scan/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender disposition
Patch/rebuild preferred on lab image; accept-with-note requires owner stub UTC.
Critical CVE on running lab container triggers rebuild row — hygiene link Module 6-1.
3. Refused
No unauthorized prod registry scan; no exploit PoC from scan output.
Scan literacy supports supply chain hygiene — not offensive chaining.
4. What you ship: image scan summary table
Three CVE rows + disposition each + NEVER exploit PoC from scan line.
5. What you record before the next lesson
Image scan summary table path.
6. Wrong vs right: stranger tenants vs YOUR cloud accounts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Pull exploit PoC for critical CVE from scan as 'learning exercise' on employer network.
Right
Image scan summary from `$CLOUD_LAB` local image. Next: Escape Named Defense.
Mission: image scan summary table
1) Run or review scan on one lab image. 2) Three CVE rows with severity. 3) Disposition per row UTC. 4) Write NEVER exploit PoC from scan line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Accept-with-note — minimum fields?”
Knowledge Check
APPLY: Image scanning literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Exploit PoC from scan hits is course lab.
True or False
Knowledge Check
APPLY: Scan disposition should:
Multiple choice