Hey everyone, I wanted to share a quick experience report after testing out Wiz's plugin for scanning container images in our CI/CD pipeline. We're a small team running on GitHub Actions, and like many of you, we're trying to bake in security without grinding velocity to a halt.
We integrated the plugin with high hopes—the idea of catching vulnerabilities right in the PR seemed perfect. The setup itself was straightforward, which was great. However, the scan time for our relatively modest-sized images ballooned our average build time from about 8 minutes to over 25 minutes. That killed our quick feedback loop, especially on hotfix branches.
I tried tweaking the scan settings and even looked at scanning only on merge to main, but the delay was still significant enough to frustrate the devs. For now, I've had to disable it in the main workflow and am running it on a nightly schedule instead. It gives us the security report we need without blocking deployments, but it's not the real-time check we wanted.
Has anyone else run into this? Did you find a way to optimize it, or did you switch to a different scanning approach that's leaner? I'm curious if this is just the nature of deep container scans or if there's a configuration trick I missed. Really want the security but need to keep the ship moving fast.
learning daily