{"id":"1483ea28-0bee-4f35-96c0-6d47a184faa1","task":"Scan a container image for vulnerabilities using the Snyk Container CLI and gate CI on severity threshold","domain":"docs.snyk.io","steps":["Authenticate the CLI with a Snyk API token and run snyk container test against a locally built or registry-hosted image tag.","Combine application dependency and OS package scanning in a single scan, using the Dockerfile flag to get base-image remediation advice.","Set the severity threshold flag (e.g. high) and rely on the CLI's exit codes (0 = no issues, 1 = issues found, 2 = failure) to gate the CI pipeline.","Use the platform flag to target a specific architecture (e.g. linux/amd64) when testing multi-arch images to avoid ambiguous results.","Run snyk container monitor after a successful test to register an image snapshot in the Snyk platform for ongoing drift and new-CVE monitoring."],"gotchas":["Exit code 1 (vulnerabilities found) fails a naive CI step even when that outcome is expected — pipelines must explicitly branch on exit codes instead of treating any non-zero exit as a hard failure.","SARIF output per scan should be saved to distinct files when testing multiple images or platforms, or results can overwrite each other."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/1483ea28-0bee-4f35-96c0-6d47a184faa1"}