Backend interview prep

Start Learning

OpenShift Image Security and Scanning

Learn how to secure container images in OpenShift using image scanning, vulnerability management, trusted registries, image signing, and enterprise DevSecOps best practices.

Introduction

A container image is the foundation of every application deployed on OpenShift.

If the image itself contains vulnerabilities, malware, outdated libraries, or exposed secrets, every Pod created from that image becomes vulnerable.

This is why enterprise organizations perform Image Security Scanning before allowing images into production.

Image scanning helps identify:

  • Operating System vulnerabilities
  • Java dependency vulnerabilities
  • Exposed secrets
  • Malware
  • Weak configurations
  • License violations
  • Outdated packages

Modern DevSecOps pipelines scan every image before deployment.

Learning Objectives

By the end of this article, you will understand:

  • Why image security is important
  • Image scanning architecture
  • Common vulnerabilities
  • Trusted image registries
  • Image signing
  • CI/CD security
  • Spring Boot image security
  • Enterprise best practices

Why Image Scanning?

Imagine deploying a Spring Boot application built six months ago.

It may contain:

  • Vulnerable Log4j version
  • Old OpenSSL package
  • Linux CVEs
  • Exposed credentials
  • Unpatched libraries

Without scanning, these vulnerabilities reach production.

Image Security Architecture

flowchart LR
    A[Developer]
    B[Git Repository]
    C[Jenkins / Tekton]
    D[Container Image]
    E[Image Scanner]
    F[Image Registry]
    G[OpenShift Cluster]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F
    F --> G

Image Scanning Workflow

sequenceDiagram
    participant Dev as Developer
    participant CI as CI Pipeline
    participant Scan as Scanner
    participant Registry
    participant OpenShift

    Dev->>CI: Push Source Code
    CI->>CI: Build Docker Image
    CI->>Scan: Scan Image
    Scan-->>CI: Scan Report
    CI->>Registry: Push Approved Image
    Registry->>OpenShift: Deploy Image

Common Security Risks

Risk Example
Critical CVEs Log4Shell
Outdated Base Image Ubuntu 18.04
Hardcoded Passwords application.properties
Malware Malicious Packages
Root User USER root
Open Ports Exposed SSH

Container Image Layers

flowchart TD
    A[Spring Boot Application]
    B[Maven Dependencies]
    C[JDK Runtime]
    D[Operating System]
    E[Container Runtime]

    A --> B
    B --> C
    C --> D
    D --> E

Each layer should be scanned.

Image Lifecycle

flowchart LR
    A[Build]
    B[Scan]
    C[Sign]
    D[Push]
    E[Deploy]
    F[Monitor]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F

Trusted Image Registries

Use trusted registries only.

Examples:

  • Red Hat Registry
  • Quay
  • Docker Hub Official Images
  • Amazon ECR
  • Azure ACR
  • Google Artifact Registry

Avoid unknown public images.

Enterprise Registry Architecture

flowchart LR
    A[Developer]
    B[Jenkins]
    C[Security Scanner]
    D[Quay Registry]
    E[OpenShift]

    A --> B
    B --> C
    C --> D
    D --> E

Secure Dockerfile

Bad Example

FROM ubuntu

USER root

Good Example

FROM registry.access.redhat.com/ubi9/openjdk-21

WORKDIR /app

COPY target/app.jar app.jar

USER 1001

ENTRYPOINT ["java","-jar","app.jar"]

Vulnerability Example

Critical

CVE-2021-44228

Library

Log4j

Severity

Critical

Recommendation

Upgrade immediately

Spring Boot Dependency Scanning

Always scan:

  • Spring Boot
  • Spring Security
  • Jackson
  • Hibernate
  • Logback
  • Log4j
  • Netty
  • Tomcat

Keep dependencies updated.

Image Signing

Image signing verifies image authenticity.

flowchart LR
    A[Container Image]
    B[Digital Signature]
    C[Registry]
    D[OpenShift]

    A --> B
    B --> C
    C --> D

Only trusted signed images should be deployed.

Image Verification

flowchart TD
    A[Deploy Request]
    B[Verify Signature]
    C{Trusted?}
    D[Deploy]
    E[Reject]

    A --> B
    B --> C
    C -->|Yes| D
    C -->|No| E

Secrets Scanning

Image scanners detect:

  • AWS Keys
  • JWT Secrets
  • Database Passwords
  • API Keys
  • Certificates

Never bake secrets into container images.

Spring Boot Best Practice

Instead of:

spring.datasource.password=Admin123

Use:

spring.datasource.password=${DATABASE_PASSWORD}

Load values from OpenShift Secrets.

CI/CD Security Pipeline

flowchart LR
    A[Git Push]
    B[Build]
    C[Unit Tests]
    D[Image Scan]
    E{Critical CVEs?}
    F[Push Image]
    G[Deploy]

    A --> B
    B --> C
    C --> D
    D --> E
    E -->|No| F
    E -->|Yes| B
    F --> G

Deployment should stop when critical vulnerabilities are found.

Banking Example

flowchart TD
    A[Developer]
    B[Jenkins]
    C[Security Scan]
    D[Quay]
    E[OpenShift]
    F[Payment Service]

    A --> B
    B --> C
    C --> D
    D --> E
    E --> F

Every payment application image is scanned before production deployment.

Recommended Image Scanners

Tool Purpose
Trivy Vulnerability Scanner
Clair Container Scanning
Red Hat ACS Enterprise Security
Snyk Dependency Scanning
Grype Image Scanning
Docker Scout Docker Security

Useful Commands

Scan Image

trivy image payment-service:1.0

List Images

oc get imagestreams

Describe Image

oc describe is payment-service

Common Problems

High Severity Vulnerabilities

Solution:

  • Upgrade dependencies
  • Rebuild image
  • Scan again

Running as Root

Fix Dockerfile.

USER 1001

Old Base Image

Use the latest supported UBI image.

Example:

registry.access.redhat.com/ubi9/openjdk-21

Secrets Found

Immediately:

  • Rotate credentials
  • Remove secrets from image
  • Use OpenShift Secrets

Production Best Practices

  • Scan every image before deployment.
  • Use trusted base images.
  • Keep Spring Boot dependencies updated.
  • Run containers as non-root.
  • Never embed secrets.
  • Sign production images.
  • Automate scanning in CI/CD.
  • Block deployments with Critical CVEs.
  • Monitor newly published vulnerabilities.
  • Rebuild images regularly.

Common Mistakes

❌ Using outdated base images.

❌ Ignoring vulnerability reports.

❌ Running containers as root.

❌ Embedding passwords inside images.

❌ Skipping image scanning in CI/CD.

❌ Pulling images from untrusted registries.

Advantages

  • Improved security
  • Reduced attack surface
  • Compliance readiness
  • Secure software supply chain
  • Automated vulnerability detection
  • Better DevSecOps
  • Enterprise-ready deployments
  • Trusted production releases

Summary

Image security is a critical part of securing OpenShift workloads.

Key takeaways:

  • Every container image should be scanned before deployment.
  • Use trusted base images and official registries.
  • Integrate image scanning into CI/CD pipelines.
  • Prevent deployment of images with critical vulnerabilities.
  • Never store secrets inside container images.
  • Combine image scanning, signing, and runtime security to build a secure software supply chain.

Interview Questions

  1. Why is image scanning important?
  2. What types of vulnerabilities can image scanners detect?
  3. Why should containers avoid running as root?
  4. What is image signing?
  5. Why should trusted registries be used?
  6. What is a software supply chain?
  7. Which tools are commonly used for image scanning?
  8. How do you secure Spring Boot container images?
  9. What should happen when critical vulnerabilities are found?
  10. What are the best practices for image security?