BM: Baca dalam Bahasa Melayu
World D5: Ship & Shield
Scan for holes: Scout and Trivy
You will learn: to scan an image for known holes, read the report and fix the worst ones.
Checked with Docker Engine 29 on 31 Oct 2026
The problem
An older nginx image. The food inspector found 232 known holes. One is CRITICAL. Where do you even start?
Watch
A vulnerability scanner: The food inspector: checks every package in an image against lists of known holes (CVEs). reads every package in the pack. It checks each one against public lists of known holes, called CVE: A public ID for a known security hole, like CVE-2099-0001. Each gets a severity.. Here is the CRITICAL one.
Tap the line that tells you the fix.
0 of 1 found
Try it
Docker’s own inspector is Docker Scout. It needs a free Docker login. Build the command that lists only the worst holes.
Tap the pieces in the right order.
Predict
The CRITICAL hole is in brotli-libs, which came with the base image. What is the best fix?
Pick one answer.
Watch
kedai:1.0 is built on nginx:1.30-alpine, with the same hole. --exit-code 1 turns a CRITICAL into a failure. Version 1.1 adds one recipe line: RUN apk upgrade --no-cache brotli-libs. Now it passes.
Check
Good scanning habit? Swipe right for yes.
Swipe right for good, left for needs work. Or use the buttons.
Scan the pack before you push it
You did it!
You can now scan an image and fix its worst holes.
Go deeper (optional)
Scout needs a Docker account and checks your local images. Trivy is open source and needs no account. Both read the packages in the image, so neither finds bugs in code you wrote. docker scout cves --exit-code returns 2 when it finds holes. Trivy’s --ignore-unfixed hides holes with no fix yet.
Real rep (optional), with Trivy installed from its official docs:
Real mission
trivy image --severity HIGH,CRITICAL alpine:3.22docker scout quickview alpine:3.22
0 of 4 steps done · Your ticks are saved.
Bahasa Melayu
Image nginx yang lebih lama. Pemeriksa makanan jumpa 232 lubang yang diketahui. Satu CRITICAL. Nak mula dari mana?
Pengimbas baca setiap pakej dalam pek. Ia semak setiap satu dengan senarai awam lubang yang diketahui, dipanggil CVE. Ini yang CRITICAL.
Pemeriksa milik Docker sendiri ialah Docker Scout. Ia perlu log masuk Docker yang percuma. Bina arahan yang senaraikan lubang paling teruk sahaja.
Lubang CRITICAL itu dalam brotli-libs, yang datang bersama base image. Apa cara terbaik membaikinya?
kedai:1.0 dibina atas nginx:1.30-alpine, dengan lubang yang sama. --exit-code 1 jadikan CRITICAL satu kegagalan. Versi 1.1 tambah satu baris resepi: RUN apk upgrade --no-cache brotli-libs. Kini ia lulus.
Tabiat imbas yang bagus? Leret ke kanan untuk ya.
Kini anda boleh imbas image dan baiki lubang paling teruknya.
You finished this before. Practice is always welcome!
Official docs: Docker Scout · docker scout cves · Trivy · Rebuild your images often
You've learned for 25 minutes. A short break helps your brain.
Sprint done! Great focus. Stretch for a minute?