Scanning DevContainer Images for Vulnerabilities

A pinned base image is reproducible but not automatically safe — it can carry known CVEs. This page scans the devcontainer image with trivy (or grype) and gates on criticals in CI, so a vulnerable base never reaches developers unnoticed.

Prerequisites

You need a scanner and the pinned image to scan.

  • trivy or grype installed (or a scan action in CI).
  • The digest-pinned image reference.
  • A CI step to run and gate the scan.

Scan prerequisitesYou need a scanner, the pinned image, a CI gate, and a refresh trigger.Scannertrivy/grypeScan imageby digestGatefail on criticalsRefreshon new CVE

Step-by-Step Implementation

  1. Scan the pinned image, failing on criticals.
trivy image --severity CRITICAL --exit-code 1 \
  mcr.microsoft.com/devcontainers/base@sha256:PINNED
  1. Add it to CI so a vulnerable base fails the build.
      - run: trivy image --severity CRITICAL,HIGH --exit-code 1 $IMAGE
  1. Generate an SBOM alongside for auditability.
syft $IMAGE -o spdx-json > sbom.spdx.json
  1. Refresh the pinned digest when a scan flags a fixable CVE.

Scan modelScanning the pinned image against CVE databases and gating criticals keeps the base safe.Pinned imagethe exact bytesScanmatch against CVE DBsGate criticalsfail the buildRefreshre-pin on fix

Common Pitfalls

Scan gaps are no gate, scanning a tag not a digest, or never refreshing.

Scan triageA triage path from an unscanned base to a gated, refreshed one.Does a scan gate run in CI?NOAdd trivy --exit-code 1Scanning the pinned digest?YESRefresh on fixable CVEsBase stays safe + current

SymptomRoot CauseRemediation
Critical CVE reaches developersNo scan gate in CIAdd trivy/grype with --exit-code 1
Scan result drifts from realityScanned a tag, not a digestScan the pinned @sha256 digest
Base never gets CVE fixesDigest pinned, never refreshedRefresh the digest on fixable CVEs
Can't answer 'are we affected?'No SBOMGenerate and store an SBOM per build

Conclusion

Pinning makes the base reproducible; scanning makes it safe. Run trivy or grype against the pinned digest in CI, fail on criticals, and refresh the pin when a fixable CVE appears. Add an SBOM and vulnerability response becomes a query instead of an investigation.

Scan and refreshScanning proves the base is clean; refreshing keeps it that way.Scan provesNo known criticalsAuditable via SBOMGated in CIThen youRefresh on fixesRe-scan the new pinRecord the change

FAQ

Isn't a pinned image already safe? Pinning makes it reproducible, not safe — the exact bytes you pinned can still contain known CVEs discovered later. Scan the pinned digest against vulnerability databases and gate on criticals, so 'reproducible' and 'safe' are both guaranteed.

Should I scan the tag or the digest? The digest — the exact image you ship. Scanning a tag can drift from what actually builds. Scan base@sha256:…, the same reference you pinned in devcontainer.json, so the scan result describes the real artifact.

How do I respond when a scan flags a CVE? If a fix exists upstream, refresh the pinned digest to the patched image, re-scan, regenerate the SBOM, and commit it as a reviewed change. The SBOM lets you quickly answer which projects are affected without rebuilding each one.