Container image scanning analyses the layers of a Docker image for known vulnerabilities in OS packages and language-specific libraries. Every container image is a software supply chain artifact — it bundles an OS base, system libraries, language runtimes, and application code. A vulnerability in any layer can be exploited at runtime. Scanning integrates into the CI pipeline to catch vulnerabilities before images reach production and into registries for continuous monitoring of already-deployed images.
Analogy🏏Cricket
🏏 Think of it like cricket: A batting coach who only reviews a batter's technique after a tournament has already ended. The batter has played 10 matches with a flawed grip — every run scored with bad technique is harder to unlearn than if the coach had corrected it in the first net session. Shifting security left is bringing the coach into the net sessions, not the post-tournament review.