I'm not asking about conventional vulnerability scanning. Traditional endpoint security tools may not inspect files inside containers because the container filesystem is isolated from the host. Do you scan container images for malware before deployment, or use a runtime security platform such as Palo Alto Prisma Cloud? There seem to be relatively few tools focused specifically on detecting malware in containers, so I'm interested in what approaches work in practice.
2 Answers
Scanning after deployment is usually too late—it mainly confirms that a bad image was promoted. Scan images before they enter the registry, then use runtime security for threats that image scanning cannot detect, such as a clean container downloading and executing something malicious after startup.
One option is malcontent in the CI/CD pipeline. It can scan container images and perform differential analysis, which helps identify unexpected files or changes before the image is promoted.
I’m not sure a vulnerability scanner would detect malware hidden in an image. What runtime tools would you use to monitor container files and processes? The processes should be visible from the host, but traditional antivirus may not be able to inspect the container filesystem directly.