# Snyk Container Security
−End-to-end container security playbook: image scanning, hardening, SBOMs, signing, and supply-chain remediation. Covers both open-source tooling (Trivy, cosign) and commercial options (Snyk Container). Includes guidance and incident remediation for the March 2026 Trivy supply-chain compromise.
+End-to-end container security playbook: image scanning, hardening, SBOMs, signing, and supply-chain remediation. Covers both open-source tooling (Trivy, cosign) and commercial options (Snyk Container). Includes precise guidance and incident remediation for the March 2026 Trivy supply-chain compromise (GHSA-69fq-xp46-6x23).
## Security incident (March 2026)
−Important: In March 2026 the Trivy ecosystem was the subject of a supply-chain compromise that injected credential-stealing malware into several official Trivy releases and GitHub Actions. If you use aquasecurity/trivy, the `aquasecurity/trivy-action` GitHub Action, or `setup-trivy`, follow the remediation checklist below immediately. (Primary sources: Docker advisory, Trivy GitHub security advisory.)
+Important: In March 2026 the Trivy ecosystem was the subject of a supply-chain compromise that injected credential-stealing malware into several Trivy releases, images, and GitHub Actions. If you use aquasecurity/trivy, the `aquasecurity/trivy-action` GitHub Action, or `actions/aquasecurity/setup-trivy`, follow the remediation checklist below immediately. (Primary sources: Trivy GitHub security advisory GHSA-69fq-xp46-6x23; Docker blog advisory Mar 23, 2026.)
+- GHSA ID: GHSA-69fq-xp46-6x23 (Aqua Security / trivy advisory published Mar 21, 2026).
+- Affected Trivy image tags (Docker Hub): `0.69.4`, `0.69.5`, `0.69.6`, and `latest` when it pointed to compromised content during the exposure window. Docker published the compromised digests and timestamps (Docker advisory, Mar 23, 2026):
+ - sha256:27f446230c60bbf0b70e008db798bd4f33b7826f9f76f756606f5417100beef3 (tagged `0.69.4`) — removed Mar 19, 2026 22:20 UTC
+ - sha256:5aaa1d7cfa9ca4649d6ffad165435c519dc836fa6e21b729a2174ad10b057d2b (tagged `0.69.5`) — removed Mar 23, 2026 01:26 UTC
+ - sha256:425cd3e1a2846ac73944e891250377d2b03653e6f028833e30fc00c1abbc6d33 (tagged `0.69.6`) — removed Mar 23, 2026 01:26 UTC
+- Affected GitHub Actions: `actions/aquasecurity/setup-trivy` versions < 0.2.6 and `aquasecurity/trivy-action` versions < 0.35.0 were replaced with malicious commits during the exposure window; patched versions: `setup-trivy` v0.2.6 and `trivy-action` v0.35.0.
−- Affected Trivy image tags (Docker Hub): `0.69.4`, `0.69.5`, `0.69.6`, and `latest` during the affected window. Docker published the compromised digests: sha256:27f446230c60bbf0b70e008db798bd4f33b7826f9f76f756606f5417100beef3, sha256:5aaa1d7cfa9ca4649d6ffad165435c519dc836fa6e21b729a2174ad10b057d2b, sha256:425cd3e1a2846ac73944e891250377d2b03653e6f028833e30fc00c1abbc6d33. (Docker advisory, Mar 23, 2026.)
+- Last-known-clean releases: `trivy` v0.69.3 (protected by GitHub immutable releases), `trivy-action` v0.35.0, `setup-trivy` v0.2.6. (Trivy advisory, Mar 21–23, 2026.)
−- Affected GitHub Actions: `aquasecurity/trivy-action` and `actions/aquasecurity/setup-trivy` had tags force-pushed to malicious commits; `setup-trivy` was affected below v0.2.6 and `trivy-action` was affected below v0.35.0. (Trivy GitHub security advisory, Mar 21–23, 2026.)
−- Known last-clean releases: `trivy` v0.69.3; `trivy-action` v0.35.0; `setup-trivy` v0.2.6. Always pin scanner tooling to immutable digests or commit SHAs and verify integrity.
## When to use
@@ −30 +34 @@
## Core concepts
−- CVE scanning: checking image layers against vulnerability databases (NVD, GitHub Advisory)
+- CVE scanning: check image layers against vulnerability databases (NVD, GitHub Advisory)
- SBOM: Software Bill of Materials — a manifest of every package in an image (SPDX or CycloneDX)
−- Image signing: cryptographic proof that an image was built by a trusted pipeline (cosign / Sigstore)
+- Image signing: cryptographic proof that an image was built by a trusted pipeline (cosign / Sigstore: fulcio/rektor)
- securityContext: Kubernetes Pod/container-level security settings (non-root, capabilities, seccomp)
−- Runtime policy: OPA Gatekeeper or Kyverno rules enforcing security constraints at admission
+- Runtime policy: OPA/Gatekeeper or Kyverno rules enforcing security constraints at admission
- Distroless: minimal images with no shell or package manager — reduced attack surface
- Supply chain: the pipeline from source to running container — every step is an attack surface
- Trivy: open-source scanner for vulnerabilities, misconfigurations, and secrets in images
−- Snyk Container: commercial scanner with fix recommendations, base image suggestions, registry integrations, and (since Apr 7, 2026) Container Registry Sync for automated image management and runtime-intelligence prioritization
+- Snyk Container: commercial scanner with fix recommendations, base image suggestions, registry integrations, and Container Registry Sync (GA Apr 7, 2026) for automated image management and runtime-intelligence prioritization
## Workflow
### Step 0: (If you used Trivy during Mar 19–23, 2026) Immediate remediation checklist
+1. Identify exposure
+ - Search for the compromised digests in local image stores, registry mirrors, artifact repositories, CI caches, and self-hosted runners. Docker published the digests above; Trivy advisory lists the exposure windows for binaries, images, and actions.
+2. Assume breach for any exposed environment
+ - Rotate all CI/CD secrets, cloud credentials, SSH keys, and tokens immediately. Treat this incident as a pipeline compromise and assume secrets were exfiltrated.
+3. Remove and quarantine
+ - Remove compromised images from registries, caches, and CI/runner stores. Replace pipeline steps that referenced floating tags (including `latest`) with pinned digests or commit SHAs.
+4. Rebuild and harden runners
+ - Rebuild self-hosted runners from known-good images, revoke long-lived tokens that runners used, and enable ephemeral credentials/OIDC where possible.
+5. Pin and verify scanner tooling
−1. Check whether your environment pulled affected Trivy images or action tags. Search for the known compromised digests in registries, local caches, mirrors, or artifact repositories (see Docker advisory digests above and Trivy GitHub advisory exposure window).
+ - Pin scanner actions/binaries to explicit commit SHAs or image digests (example: `uses: aquasecurity/trivy-action@<commit-sha>`). When available, verify signatures (sigstore/cosign) and record verified digests in build metadata. Prefer scanner artifacts published with sigstore signatures or by vendors that support immutable releases.
−2. If you used any affected artifact during the exposure window, rotate all CI/CD secrets, cloud credentials, SSH keys, and tokens immediately. Treat this as a breach and assume secrets were exfiltrated.
−3. Remove compromised images from registries and CI caches. Replace any pipeline steps that referenced floating tags (including `latest`) with pinned digests or commit SHAs.
−4. Inspect self-hosted runners for persistence or malware. Rebuild runners from known-good images and revoke long-lived tokens used by runners.
−5. Pin scanner tooling in CI to explicit commit SHAs or image digests and validate integrity (example: use `uses: aquasecurity/trivy-action@<commit-sha>` or pin to a digest where supported).
−References: Docker advisory (Mar 23, 2026), Trivy GitHub security advisory (GHSA-69fq-xp46-6x23).
+References: Trivy GitHub security advisory GHSA-69fq-xp46-6x23 (Mar 21, 2026), Docker blog "Trivy supply chain compromise" (Mar 23, 2026).
−### Step 1: Scan images in CI (updated)
+### Step 1: Scan images in CI (updated recommendations)
+- Integrate Trivy and/or Snyk into CI but always pin scanner artifacts to immutable references and verify integrity before running them.
+- Fail builds on CRITICAL or HIGH severity by policy, but use runtime-prioritization signals (if available) to focus remediation on exploitable vulnerabilities.
+- Avoid floating tags for tooling (no `latest`). Record the digest/commit used in pipeline metadata for provenance.
−Integrate Trivy and/or Snyk into the CI pipeline. Fail the build on CRITICAL or HIGH severity vulnerabilities. Important hardening additions after the Trivy incident:
+- If you maintain a large registry, consider Snyk Container Registry Sync to import and prune images by rules so scans target in-use images (Snyk blog, Apr 7, 2026).
+Example (pin Trivy action by commit SHA):
−- Pin the scanner action/binary to a specific commit SHA or image digest (avoid floating tags like `latest`).
+- uses: aquasecurity/trivy-action@<commit-sha>
−- Prefer known-good/signed artifacts. When vendors publish signatures, verify them before running the scanner.
−- Add a CI step that verifies the scanner image digest or action SHA before running it and records the digest in your build metadata.
−- If using GitHub Actions, avoid `pull_request_target` for workflows that checkout or run external code; prefer safer patterns.
−- For large registries, consider Snyk Container Registry Sync (GA Apr 7, 2026) to auto-import and prune images so scanning is focused on in-use images and reduces alert fatigue.
+Example (verify image digest before running in CI):
−Example (pin Trivy action by tag or commit SHA):
+- Run a lightweight step before the scanner: pull digest via registry API and compare to expected sha256; fail if mismatch.
−
−- uses: aquasecurity/trivy-action@v0.35.0 # or uses: aquasecurity/trivy-action@<commit-sha>
### Step 2: Harden the Kubernetes securityContext
+- Drop all capabilities and add back only what is required
+- runAsNonRoot: true
+- readOnlyRootFilesystem: true (use emptyDir writable mounts where needed)
−Apply restrictive security settings at both the Pod and container level. Drop all capabilities and add back only what is needed. Set runAsNonRoot, readOnlyRootFilesystem, and an appropriate seccompProfile.
+- seccompProfile: RuntimeDefault or custom restrictive profile
### Step 3: Manage secrets securely
+- Never bake secrets into image layers. Use Kubernetes Secrets with external secret operators or CSI drivers.
−Never bake secrets into image layers. Use Kubernetes Secrets, external secret operators, or mounted volumes from a secrets manager. Ensure CI secrets are short-lived and rotated automatically where possible.
+- Use short-lived CI secrets and OIDC-based tokens for pipeline steps where supported.
−### Step 4: Generate an SBOM
+### Step 4: Generate and store an SBOM
+- Generate SPDX or CycloneDX SBOMs at build-time and attach them to images in the registry.
