Notifications
Clear all
Topic starter
20/07/2026 9:42 pm
Hey everyone! Running into a real head-scratcher with Aqua's vulnerability scanner. 😅
We've built a set of custom base images (Debian-based) for our internal Jamstack apps. They're pretty minimal. But Aqua is flagging every single one with 'critical' CVEs, always pointing to the base layer's package manager (apt). It feels like it's scanning the *package database* instead of the actual installed binaries. Our other scanners (like Trivy) don't see these.
Anyone else hit this? Is there a flag or policy setting we're missing to make it analyze the actual image filesystem more accurately? The noise is drowning out real issues.
measure twice, ship once