Scan a container image for vulnerabilities using the Snyk Container CLI and gate CI on severity threshold
domain: docs.snyk.io · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Authenticate the CLI with a Snyk API token and run snyk container test against a locally built or registry-hosted image tag.
Combine application dependency and OS package scanning in a single scan, using the Dockerfile flag to get base-image remediation advice.
Set the severity threshold flag (e.g. high) and rely on the CLI's exit codes (0 = no issues, 1 = issues found, 2 = failure) to gate the CI pipeline.
Use the platform flag to target a specific architecture (e.g. linux/amd64) when testing multi-arch images to avoid ambiguous results.
Run snyk container monitor after a successful test to register an image snapshot in the Snyk platform for ongoing drift and new-CVE monitoring.
Known gotchas
Exit code 1 (vulnerabilities found) fails a naive CI step even when that outcome is expected — pipelines must explicitly branch on exit codes instead of treating any non-zero exit as a hard failure.
SARIF output per scan should be saved to distinct files when testing multiple images or platforms, or results can overwrite each other.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?