Scanning a base image is half the answer

A scanner reports what it can identify from package metadata, and a binary copied into an image during the build has none.

$ trivy image app:2021-12-14
Total: 14 (HIGH: 3, CRITICAL: 1)

# what it found:  apk and composer packages
# what it did NOT find:
#   a vendored library copied in with COPY
#   a static binary downloaded by a RUN
#   a JAR bundled inside another artefact
#   anything in a volume mounted at runtime

The blind spots are consistent and worth writing down next to the scan, because a green scan is otherwise read as “no vulnerabilities” rather than “no vulnerabilities in the parts I can see”. Everything installed by a curl | sh in a Dockerfile is invisible to every scanner. The other half is the alert volume: a base image scan reports the same forty low-severity findings every day, and a policy that only fails on high severities with a fix available is what keeps anybody reading it.