4.7Building a Scanning Pipeline

The recommended approach layers scans at multiple points:

Developer machine          CI Pipeline              Registry           Runtime
    |                         |                        |                  |
    |-- Hadolint             |-- Build image          |-- Scan on push  |-- Falco
    |   (Dockerfile lint)    |-- Trivy scan           |-- Daily rescan  |   (anomaly
    |                        |-- Grype scan           |-- Block pulls   |    detection)
    |-- docker scan          |-- Fail on CRITICAL     |   of vulnerable |
    |   (quick local check)  |-- Generate SBOM        |   images        |
    |                        |-- Upload to registry   |                  |

Sample CI Stage

#!/bin/bash
# scripts/scan-container.sh
set -euo pipefail

IMAGE="$1"
SEVERITY_THRESHOLD="${2:-HIGH}"

echo "=== Scanning $IMAGE ==="

# Stage 1: Dockerfile lint
echo "--- Hadolint ---"
hadolint Dockerfile --failure-threshold warning

# Stage 2: Image vulnerability scan
echo "--- Trivy ---"
trivy image --exit-code 1 --severity "$SEVERITY_THRESHOLD" "$IMAGE"

# Stage 3: SBOM generation
echo "--- SBOM ---"
trivy image --format spdx-json -o "sbom-$(date +%Y%m%d).json" "$IMAGE"

# Stage 4: Cross-reference with Grype
echo "--- Grype ---"
grype "$IMAGE" --fail-on high

echo "=== All scans passed ==="

This layered approach ensures that even if one scanner misses a CVE, another catches it. The SBOM provides an audit trail for future vulnerability disclosures.