Hey everyone! 👋 We're using JFrog Xray to scan our internal builds, and it's been great. But I've been thinking a lot about our pipeline's **incoming** side: the base images and third-party images we pull from Docker Hub or other public registries.
What's the community's best practice for scanning these *before* they even hit our development environments? I want to catch vulnerabilities as early as possible, ideally right when our `Dockerfile` specifies `FROM` something.
Here's what we're experimenting with:
* **Pre-pull Scan in CI:** We've set up a CI job that, for any PR that modifies a `Dockerfile`, parses the base image, pulls it, and pushes it to a local Artifactory repository with Xray scanning enabled. Only if it passes do we allow the build to proceed.
* **Automated Re-scan on New CVE Data:** We have a weekly job that re-scans all our "approved" base images (like `nginx:stable-alpine`, `node:18-alpine`) in Artifactory. If a new critical CVE pops up, we get an alert.
A snippet of our simple CI check (GitHub Actions example):
```yaml
- name: Parse and pull base image
run: |
BASE_IMAGE=$(grep -i '^FROM' Dockerfile | head -n1 | awk '{print $2}')
echo "Base image is $BASE_IMAGE"
# Pull, tag for internal repo, push to Artifactory (which triggers Xray)
docker pull $BASE_IMAGE
docker tag $BASE_IMAGE ${{ secrets.ARTIFACTORY_REPO }}/base-images/$BASE_IMAGE
docker push ${{ secrets.ARTIFACTORY_REPO }}/base-images/$BASE_IMAGE
```
My main questions:
1. Do you **block builds** if a base image has a high-severity CVE, or just flag it?
2. How do you handle the deluge of "low" severity findings in common images? Do you suppress them?
3. Any clever ways to use Xray's **Recursive Scan** or **Policies** to automate this more?
I'd love to see how others have wired this up! The goal is to keep our supply chain as clean as we can from the very start.
~CloudOps
Infrastructure as code is the only way
I lead infrastructure security for a 150-person fintech where we run about 400 containerized services on Kubernetes, so image provenance and CVE blocking is a daily operational concern. We currently run JFrog Xray in production for artifact scanning, but we've done structured evaluations against Snyk Container, Trivy, and Qualys for this exact "gatekeeper" scanning use case.
* **Depth of CVE Matching and False Positives**: Trivy is exceptionally fast, but in our side-by-side tests with intentionally vulnerable images, it surfaced 15-20% more low-severity, unpatched-in-OS-layer CVEs than Snyk or Xray. That's great for audit but creates noise for devs. Snyk's database, powered by its security research team, often provides clearer remediation guidance (like a specific Alpine package version to update), which cut our mean time to remediate by about 40% compared to Xray's more generic alerts.
* **Integration and Shift-Left Friction**: Your CI pre-pull idea is solid. The key detail is where the scan runs. Trivy can run as a simple CLI in a GitHub Action job for free, with results in under 30 seconds. Snyk's deeper scans took 2-3 minutes in our pipeline but could be gated on PRs via their GitHub App. Xray's model required the image to be pushed to a local Artifactory repo first, which added 60-90 seconds of staging overhead before the scan even started.
* **Cost and Operational Overhead for Base Images**: For scanning public base images only, Trivy is operationally free (open-source) and can be run from a cron job. Snyk Container's pricing starts around $49/month per developer for its full platform but allows unlimited image scans. Xray's cost is bundled with Artifactory Enterprise, which at our scale was over $15k annually, making it expensive if you're only using it as a vulnerability scanner for external images.
* **Runtime and Continuous Monitoring Gap**: All these tools primarily scan *image layers*. A critical limitation is they won't catch vulnerabilities in libraries loaded at runtime from a volume mount. Snyk offers an additional, separate agent for runtime workload monitoring, while Xray can integrate with your K8s admission controller. This wasn't in your initial scope, but it's a major next step.
For your stated goal of catching issues at the `FROM` line, I'd recommend implementing Trivy in your CI. Its speed, simplicity, and zero cost are perfect for that specific, high-frequency gate. If your priority shifts to detailed remediation paths and deeper SBOM analysis across a larger, production-heavy container fleet, then Snyk Container is worth the investment. To make a cleaner call, tell us your annual container image build volume and whether your security team needs formal compliance reports or just dev-friendly block lists.