Vulnerability scanning

Every image we publish is scanned for known vulnerabilities after each production build. The results are public, and the numbers to watch are the fixable ones.

When and how images are scanned

A scan runs after every production publish. That covers each release, the Tuesday 08:00 UTC weekly rebuild, and the runs that ship new PHP patches. Grype scans the linux/amd64 image of every published tag, pulled from GitHub Packages.

The scan job has no access token and no registry credentials, and Grype runs in its own container. A compromised scanner would have nothing to steal and nothing it could publish.

See the latest results

Open the latest successful production run. Its summary page has a table for each variation with every image's critical, high, and medium counts, and how many findings have a fix.

Findings that have a fix also become code scanning alerts for the maintainers. Each one closes once a scan no longer finds it.

Most findings have no fix yet

A scanner matches every package in the image against public CVE databases. Many of the CVEs it reports are ones the distribution has marked "not fixed" or "won't fix", so there is no newer package to install. A scan of 8.5-cli-bookworm found 18 critical and 144 high CVEs, and none of them had a fix.

No rebuild can change an unfixed finding. The fixable count is the meaningful number. The docker-library project explains this in more depth in Why does my security scanner show that an image has CVEs?

Scan it yourself

You don't have to rely on our scan. The images are public and work with any scanner:

grype serversideup/php:8.5-cli --only-fixed

To report a problem in our own scripts, configs, or workflows, use private vulnerability reporting instead.