Container image scanning is the analysis of a container image before deployment to find known vulnerabilities, misconfigurations, and embedded secrets. A scanner inspects image layers, installed packages, configuration files, and sometimes the filesystem content inside the image. The goal is to catch security problems early, while they are still cheap to fix.
This matters because a container often starts from a shared base image, so one weak library or exposed credential can be copied into many workloads. Attackers may exploit outdated packages, maliciously change build artifacts, or abuse secrets accidentally baked into an image. Defenders use scanning in CI/CD pipelines, during registry uploads, or as a deployment gate to block risky images. Good scanning does not guarantee safety, but it reduces preventable exposure and gives teams a repeatable control point before a container ever reaches production.