11.1.2.1 Image OS Package Scan
A focused guide to Image OS Package Scan, connecting core concepts with practical Docker and container operations.
Image OS package scan checks an image's operating-system-level packages — those installed through the base distribution's own package manager, like apt or apk — against known vulnerability databases, distinct from scanning an application's own language-specific dependencies.
What an OS Package Scan Actually Covers
A scan at this level inspects the packages installed via the base image's system package manager, the foundational layer beneath an application's own code and dependencies.
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y curl
docker scout cves myapp:1.0
A scan against this image would report findings related to curl, ubuntu's base packages, and anything else installed at this operating system level.
Why OS-Level Vulnerabilities Are a Distinct Category
A vulnerability in an OS-level package (a system library, a core utility) is a different category of risk than a vulnerability in an application's own language-specific dependency, often requiring a different remediation path — typically rebuilding against an updated base image rather than updating an application dependency file.
FROM ubuntu:22.04
docker build --pull -t myapp:1.0 .
Rebuilding with --pull ensures the latest version of the base image, including its latest OS-level security patches, is used.
Why Minimal Base Images Reduce This Particular Scan Surface
A more minimal base image, with fewer OS-level packages installed in the first place, correspondingly has less OS-level scan surface and fewer potential findings in this specific category.
FROM alpine:3.19
Reviewing OS Package Scan Findings Specifically
Filtering scan results to this specific category helps focus remediation effort appropriately.
docker scout cves myapp:1.0 --type os
Why Image OS Package Scan Matters
Understanding that OS-level package vulnerabilities are a distinct category, generally remediated by updating the base image rather than an application dependency, helps direct remediation effort correctly when this kind of finding appears in a scan.