Container scanning policy

We perform internal container scans for all of our officially supported images. Please read the dedicated section in our versioning policy to find out which images receive official support.

More specifically we schedule a daily job that searches for vulnerabilities using a Trivy scan with standard configuration. We process the resulting findings as follows:

1. We filter out findings that do not have a severity of 'critical', 'high' or 'medium'.

2. We also filter out findings that do not have a status of 'fixed'.

3. For the remaining findings, we look at the finding's severity as dictated by the Trivy scan to determine how urgently we need to fix it. For 'critical' vulnerabilities we publish a patch release within 3 business days. Findings with a severity of 'high' or 'medium' get a fix within 9 and 27 business days respectively.

On top of this we only publish a release if at that point in time our Trivy scan finds no 'critical', 'high' or 'medium' vulnerability that has a 'fixed' status.