Most production Docker images are security debt waiting to be called in. The average enterprise container image carries 200+ known vulnerabilities. About 15% of those are critical or high severity.

Here's a systematic audit process you can run in five minutes.

Step 1: Run Trivy Against Your Image 

docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \ aquasec/trivy image your-image:latest \ --severity CRITICAL,HIGH \ --format table

Trivy pulls CVE data from multiple feeds (NVD, GitHub Advisory, Alpine SecDB, etc.) and maps them to your installed packages.

Step 2: Filter by Fixable Vulns Only

The output will include unfixable vulnerabilities — issues in packages where no upstream patch exists yet. Filter those out:

trivy image your-image:latest --ignore-unfixed --severity CRITICAL

Focus your energy where it can make an immediate difference.

Step 3: Trace Back to the Base Image

80% of container CVEs come from the base image, not your application code. If you're on ubuntu:22.04, you're inheriting its entire package surface area. Switch to distroless or minimal variants:

  • gcr.io/distroless/base-debian12 — no shell, no package manager, minimal attack surface
  • alpine:3.19 — if you need a shell, Alpine's minimal footprint dramatically reduces CVE count
  • php:8.2.35-fpm-alpine — application-specific minimal images

Step 4: Pin Exact Versions

FROM php:8.2 resolves to whatever the latest 8.2.x is at build time. After CVE-2026-109618 dropped, images built with a pinned 8.2.34 were vulnerable while teams scrambled to rebuild. Images pinned to 8.2.35 were already protected.

Always pin. Always.

Step 5: Automate in CI

Manual audits are snapshots. Vulnerabilities appear continuously. Add Trivy (or Snyk, Grype) to your CI pipeline so every PR gets a CVE scan before it merges.

The Scale Problem

A single team managing 50+ images cannot run this process manually in any sustainable way. At enterprise scale, the answer isn't better tooling — it's autonomous remediation that identifies the vulnerable image, rebuilds with the patched base, and deploys without waiting for a human to approve each change.

That's what Cognitive Daniel does at fleet scale. Check out how we approach autonomous container hardening at cognitivedaniel.com.