In this section, we will review DTR's security features, such as security scanning and image signing.
Security scanning
DTR includes image security scanning as a built-in feature. It will scan each image's layer for binaries and libraries. A scan report will include the aggregated BOM for each layer. We now have a complete picture of an image's files and its MD5 hashes. This ensures the immutability of each layer's content between image releases. If we change a file within a layer, its hash changes and scanning will be executed against the new layer's content. Image scanning will also download and manage a CVE database provided by Docker. This will be used to correlate an image's layer reports with the vulnerability information given.
Scanning will show us a report regarding the health of our image, reporting all detected well-known vulnerabilities found on the image's layers.
This CVE database should be updated frequently...