Image Scanning and Supply Chain Checks
Supply chain compliance asks two questions: what is in the thing you ship, and what is known to be wrong with it. An SBOM answers the first and a scanner answers the second. This guide runs both against a stale image and a minimal one, and reads what the answer depended on.
Compliance and Frameworks Guide 39 of 42 Intermediate
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 16 min
Trivy 0.67.2, run as an ordinary Pod with no privilege. It fetches images from the registry itself and downloads a vulnerability database at run time, which is why the same scan can give a different answer tomorrow.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA5001 | 192.168.0.41 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE01 | 192.168.0.42 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE02 | 192.168.0.43 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE03 | 192.168.0.44 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when supply chain compliance has to answer what is inside the thing you ship. This matters because the same scanner against two images gives wildly different results - and the difference is the base image rather than the application.
- running a scanner as an ordinary Pod with no privilege at all
- scanning a stale base image and reading the findings by severity
- counting findings against components, and against the size they were found in
- scanning a minimal image with the same scanner in the very same minute
- reading the scanner's own log about what the answer actually depended on
Before you start
-
One scanner, two images
-
A stale base image, by severity
-
Findings against components
-
The same scan against a minimal image
-
What the answer depended on