Docker Image Vulnerability Scanner

Scan any public Docker image for CVEs. No Docker daemon, no signup.

Any public image on Docker Hub, GHCR, GCR, Quay, ECR Public, registry.k8s.io or MCR. Tag or digest.

Try:

Multi-arch tags hold one image per platform. We scan linux/amd64 unless you pick another.

Public images only. We never ask for registry credentials.

What this tool does, and what it doesn't

You give us an image reference. We ask the registry for its manifest, pick the platform build, walk its layers newest first, read the package database out of them (dpkg, apk or rpm), and match every installed package against the OSV vulnerability database. You get the CVEs, their severity, and the version that fixes each one.

Public images only. There is nowhere to enter registry credentials, and that is on purpose: a free public form is the last place anyone should paste a registry password. If an image needs auth, we say so and stop.

We don't download the whole image. Layers are decompressed in flight, never written to disk, and the walk stops as soon as it has the package database - which on a typical application image is well before the base layers.

OS packages, not your app. This reads the distribution's package database. The npm, pip and Go dependencies you COPY in are not in it, so they are not covered here.

Zero is not always an all-clear, and we say which. If we hold no advisory feed for the image's distribution - a distro we don't cover, or a release the feed hasn't reached - you get that sentence instead of a green zero. Same for a distroless image with no package manager, and same for an image whose database we couldn't read.

Scanning a live server instead of an image?

The Linux Package Vulnerability Scanner takes a pasted dpkg -l / rpm -qa / apk info -v listing and runs the same OSV match against it.

FAQ

How do I scan a Docker image for vulnerabilities for free? +
Type the image reference (nginx:1.21, ghcr.io/owner/repo:tag, or an image@sha256: digest) and we pull its manifest from the registry, read the package database out of its layers, and match every installed package against the OSV vulnerability database. No signup, no Docker daemon, and nothing to install - the pull happens on our side.
Which registries can you scan? +
Public images on Docker Hub, GitHub Container Registry (ghcr.io), Google Container Registry (gcr.io and its regional hosts), Quay, Amazon ECR Public, registry.k8s.io and Microsoft Container Registry. We only scan images that can be pulled anonymously - there is nowhere to enter credentials, which is deliberate: a free public form should never be a place people paste registry passwords.
What does it mean if my image has no packages? +
Distroless and scratch-based images ship no package manager, so there is no package database to read and nothing for a package-level scanner to match. That is a real result, not a failure, and we say so explicitly rather than showing you a zero. It also does not mean the image is risk-free: your application's own dependencies (npm, pip, Go modules) are still there and are not covered by this tool.
Does a result of zero CVEs mean the image is safe? +
It means we found no advisories affecting the installed OS packages for that image's distribution, at the moment you ran it. We tell you explicitly when we hold no advisory feed for the distribution at all - a distro we do not cover, or a release the feed has not reached yet - because a count of zero there means we have no data, not that there is nothing to find. It also covers OS packages only, not the application dependencies bundled into the image.
Do you download the whole image? +
No. We walk layers newest first and stop as soon as we have the package database, which on a typical application image skips most of the bytes. Nothing is written to disk: layers are decompressed in flight and only the package database is kept, for as long as the scan takes. Total download is capped, and if we hit the cap we tell you the result is partial rather than pretending it is complete.
Can I scan every image I push, automatically? +
Yes, and that is the version worth having. Fivenines scans the container images actually running on your servers, keyed by digest, and re-checks them whenever new advisories are published - so you hear about a CVE that lands a month after you deployed, which no one-off scan can tell you. Plans start at €19/month with a 14-day free trial.

Scan every image you push, in CI and in production.

Fivenines scans the container images your servers actually run, by digest, and re-checks them as new advisories land. 14-day trial, no credit card.

Start free trial

14-day trial. No credit card required.