Layered Security Analysis for Container Images: Expanding Lightweight Pre-Deployment Scanning

Containerization using tools such as Docker has transformed the way applications are deployed and managed in various organizations. However, the use of containers also presents new security challenges due to the potential vulnerabilities that may be present in the container images. To address this, various vulnerability detection tools that use static analysis have been developed that focus more on OS packages, and fail to detect known package vulnerabilities. In this paper, we propose a pre-deployment methodology that detects vulnerabilities in container images targeting both the OS and application packages using a layered approach, where static tools generally fail to detect vulnerabilities in those images. Our solution offers a high degree of customizability and control over its performance in detecting vulnerabilities in images. Users can choose a specific scan profile that is tailored to their particular needs, enabling the detection of vulnerabilities that are either more common, more unique, or a balance of the two. This adaptability makes our solution more flexible and better suited to meet the specific needs of our users. We evaluate our proposed framework against 111 both official and community images collected from Docker Hub to demonstrate its effectiveness compared to other popular static analysis tools for containers.