Just deployed the latest Xray version to test the new 'reachability analysis' for container images. They claim it cuts noise by checking if a vulnerable function is actually called in your runtime code.
My early take: it's not *just* fluff, but the value is situational.
* It significantly reduced alerts on our base Node.js images. Many deep, unused library vulnerabilities got filtered out.
* However, for our own application code, it's less effective. If your app imports a vulnerable library, Xray flags it as reachable even if the vulnerable function is never called. So you still get the alert.
* The analysis needs the full container image and seems to add ~20-30 seconds to the scan for a mid-sized image.
Main benefit so far is cleaning up base image and OS package noise. Won't replace the need for good SCA scanning on your source code.
Has anyone else run it in production? Curious if your experience matches mine, especially with compiled languages like Go or Java.