Containerization has become a dominant method for software delivery and deployment including Cyber-Physical systems 1. Docker, emerging as the leading platform in this space, suffers from security issues, particularly due to their layered architecture. If a base image contains vulnerabilities, all derived images inherit them. Therefore, regular and thorough scanning of Docker images is essential to maintain security. In this paper, we evaluate several existing static analysis tools and identify a key limitation: most scanners overlook software manually added to images, such as custom binaries or software installed outside of package managers. To address this gap, we present a new tool that (1) detects manually added software within Docker images and (2) scans these files for vulnerabilities. We validated our method using a dataset of 50 Docker images. The results cross-validate previous studies 2 and show that our tool successfully complements existing scanners by detecting additional, previously unnoticed vulnerabilities. It sometimes identified up to 415 more vulnerabilities even in the top pulled images. By combining static and binary analysis, our approach significantly enhances container security.
Khasanov et al. (Mon,) studied this question.
Synapse has enriched 5 closely related papers on similar clinical questions. Consider them for comparative context: