Most production Docker images are security debt waiting to be called in. The average enterprise container image carries 200+ known vulnerabilities. About 15% of those are critical or high severity.

Here's a systematic audit process you can run in five minutes.

Step 1: Run Trivy Against Your Image

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ aquasec/trivy image your-image:latest \ --severity CRITICAL,HIGH \ --format table

Trivy pulls CVE data from multiple feeds (NVD, GitHub Advisory, Alpine SecDB, etc.) and maps them to your installed packages.

Step 2: Filter by Fixable Vulns Only

The output will include unfixable vulnerabilities — issues in packages where no upstream patch exists yet. Filter those out:

trivy image your-image:latest --ignore-unfixed --severity CRITICAL

Focus your energy where it can make an immediate difference.

Step 3: Trace Back to the Base Image

80% of container CVEs come from the base image, not your application code.…