Comparison
Image scanningvsSoftware supply chain
Image scanning
the pipeline compares every package in the image against a vulnerability feed and fails the build on anything critical.
Inventorying an image's operating system and language packages and matching them against known-vulnerability databases. It is cheap, automatable and genuinely effective at catching stale base images; it is also a well-known source of alert fatigue, because most findings are in components your code never calls. Scanning at build time and again in the registry matters, since a passing image acquires new findings over the following weeks without changing a byte.
Full entry →Software supply chain
your artefact contains code from four hundred projects you have never read and a build system nobody has audited.
Everything that contributes to a released artefact: dependencies, base images, build tools, the pipeline itself and the people with access to any of them. Attacks target it because compromising one widely-used link reaches everyone downstream, and because it is much less defended than production. The defences are dull and effective — pin versions, verify what you pull, build hermetically, sign what you publish, and know what is inside.
Full entry →