How to Scan AI Container Images for Vulnerabilities in CI

AI service images tend to include a lot: Python, system libraries, machine learning frameworks and all their dependencies. Any of those can carry known vulnerabilities, and enterprise security teams will ask how you find and fix them. Scanning in CI answers that question before an image reaches the registry.

Step 1: Choose a scanner

Trivy is a widely used open-source scanner that checks operating system packages and language dependencies. Grype is a similar alternative, and most cloud registries, including Amazon ECR and Google Artifact Registry, can also scan images after they're pushed.

Step 2: Scan in the pipeline

- name: Build image
  run: docker build -t ai-service:${{ github.sha }} .
- name: Scan image
  uses: aquasecurity/trivy-action@0.x.y   # pin a version you've tested
  with:
    image-ref: ai-service:${{ github.sha }}
    severity: CRITICAL,HIGH
    ignore-unfixed: true
    exit-code: "1"

This fails the build when a critical or high vulnerability with an available fix is found. Ignoring unfixed issues stops the pipeline from blocking on problems nobody can resolve yet.

Step 3: Record accepted risks

Some findings won't affect your usage, or won't have a fix. Record them in a .trivyignore file with the vulnerability ID, a reason and a review date, and have security approve each addition. An ignore list without reasons quietly becomes permanent.

Step 4: Rescan what's already deployed

New vulnerabilities are published every day for images you built months ago. Rescan running images on a schedule, or turn on continuous scanning in your registry, and alert owners when a new critical issue appears.

Step 5: Reduce what there is to scan

Smaller images have fewer findings. Use slim base images, multi-stage builds and only the packages you import. Rebuilding regularly on updated base images fixes many operating system findings without any code change.

Step 6: Produce an SBOM

Generate a software bill of materials alongside the scan, for example with trivy image --format cyclonedx. When the next widely publicized vulnerability appears, you can search your SBOMs instead of rebuilding every image to check.

Things to watch

• GPU base images are large and often carry many findings. Keep them updated, and keep GPU services separate from simple API-calling ones.
• Model files aren't covered by package scanners. Treat downloaded models as untrusted input, and prefer safe formats like safetensors.
• Alert fatigue. Hundreds of low-severity findings bury the important ones. Start by enforcing critical issues only.

Add the scan step to one service's pipeline this week, and fix whatever it finds first.