A container image is more than your app.

It's an entire filesystem, built on a base OS with its own hundreds of packages — each potentially carrying CVEs entirely separate from anything SCA checks.

What's actually inside an image

Your application code

App dependenciesSCA's territory (Module 2)

Language runtimee.g. Node.js, Python — can have CVEs

Base OS layere.g. ubuntu:22.04 — image scanning's territory

trivy

# only high/critical, CI-friendly
trivy image --severity HIGH,CRITICAL nginx:1.25.0

# fail the build; ignore CVEs with no patch yet
trivy image --exit-code 1 --severity CRITICAL \
  --ignore-unfixed myapp:latest

# scan the Dockerfile / K8s manifests too
trivy config ./Dockerfile

Image scanning targets the base OS and runtime layers specifically — the part SAST and SCA never look at.