One thing to watch out for, when using container scanning tools, is how they handle "unfixed" vulnerabilities in images based on Debian/Ubuntu. Both those dist

One thing to watch out for, when using container scanning tools, is how they handle "unfixed" vulnerabilities in images based on Debian/Ubuntu. Both those distros maintain a list of CVEs that they know of but don't have a patch for. Traditional VA tools (e.g. Nessus) default to not flagging those, but a lot of container scanning tools will default to showing them, so you end up seeing wildly different results. (some more details https://raesene.github.io/blog/2020/11/22/When_Is_A_Vulnerability_Not_A_Vulnerability/ https://raesene.github.io/blog/2020/11/22/When_Is_A_Vulnerab...) Whether you consider this a problem is ofc, dependent on your threat model, but it's one to consider. (full disclosure, I work for a company that makes Trivy , but not on that project :) )