Container Security Tools Compared: Image Scanning, Runtime Defense, and Open-Source Picks

A container image is a stack of tarballs holding someone else's operating system packages, and the base image you picked six months ago keeps shipping to production every time CI runs. Containers share the host kernel, live for minutes, and get rebuilt constantly, which means the security question is never answered once.

Here is how wide the gap between free and paid has become. On September 2, 2026, scanning node:18-alpine with Trivy returned 17 HIGH and CRITICAL operating system vulnerabilities. Scanning alpine:3.20 returned zero. That is one line of a Dockerfile, found by an Apache-2.0 binary with 37,738 GitHub stars. Meanwhile Google closed its $32 billion acquisition of Wiz on March 11, 2026, the largest acquisition in Google's history, for a platform solving a problem that overlaps heavily with what that free binary just did.

Both facts are true, and the reason is that "container security" is three different jobs.

The Three Jobs

Build-time scanning reads an image or a manifest and compares what it finds against a vulnerability database. It runs in CI, it is fast, and it catches known CVEs and misconfigurations before anything deploys. It cannot see a live process.

Runtime detection watches kernel events on running workloads and alerts when a container does something it should not, like spawning a shell or reading /etc/shadow. It catches zero-days and active exploitation that no database knew about. It cannot stop a vulnerable image from shipping.

Posture and compliance evaluates cluster configuration against a framework such as CIS Benchmarks or SOC 2 and answers the auditor's question rather than the attacker's.

Most teams need one tool from each. Buying a platform that claims all three is a budget decision, not a coverage decision.

Build Time: Scanning Before It Ships

Trivy

Trivy is the default answer for most teams, and v0.74.0 shipped on August 14, 2026. One Go binary scans container images, filesystems, Git repositories, Kubernetes clusters and IaC files, covering CVEs, misconfigurations, exposed secrets and SBOM generation. It pulls images straight from a registry, so you do not need a Docker daemon to scan one.

The misconfiguration scanner is the underrated half. Running trivy config against a deliberately careless Dockerfile returned 4 failures out of 27 tests, and the CRITICAL one was DS-0031, secrets passed through environment variables, catching a hardcoded token in an ENV line. DS-0002 flagged USER root. Neither is a CVE, and both are how containers actually get compromised.

What Trivy does not give you is prioritization with context. A scan can return 200 findings and treat an internet-facing API the same as a batch job that runs monthly. Triage is your problem.

License: Apache-2.0 · Cost: free · Maintained by: Aqua Security

Grype

Grype reached v0.118.0 on August 27, 2026 and takes the SBOM-first path. Pair it with Syft to generate a bill of materials once, then scan that artifact repeatedly without re-reading the image. If you already produce SBOMs for supply chain compliance, Grype fits the pipeline you have. It is narrower than Trivy by design, doing vulnerability matching well and leaving IaC and secrets alone.

License: Apache-2.0 · Cost: free · Maintained by: Anchore

Docker Scout

Docker Scout wins on friction. If your team already pays for Docker, it is one command away and results appear in Docker Hub next to the image. The catch is repository limits: the Personal plan covers one Scout-enabled repository and Pro at $11 per user per month covers two. Unlimited repositories start at Team, $16 per user per month, with Business at $24.

For a team with one flagship image, the free tier is genuinely enough. For a microservice fleet, the per-repo limit pushes you up the plans quickly.

Snyk Container

Snyk Container leads with base image remediation advice, telling you which upgrade clears the most CVEs rather than only listing them. Snyk's Free tier covers SCA, SAST, IaC and Container for a single developer, Team starts at $25 per developer per month, and Ignite starts at $1,260 per developer per year. Note that Snyk Container is sold to bundle with Snyk Open Source, so the container piece is rarely a standalone line item.

Runtime: What Scanning Cannot See

Falco

Falco is a CNCF graduated project, the foundation's highest maturity tier, and 0.44.1 landed on June 11, 2026. It uses eBPF to watch kernel events and applies rules to them, so a container that suddenly executes a shell, mounts a sensitive path or opens an unexpected outbound connection generates an alert in real time. This is the layer that catches the exploit your scanner had no CVE for.

Falco is detection-only. It tells you something happened; it does not stop it. Budget real time for rule tuning, because the default ruleset is noisy against most production workloads and an ignored alert stream is worth nothing.

License: open source (Apache-2.0) · Cost: free

Tetragon

Tetragon is a sub-project under Cilium, itself CNCF graduated, and it is the option to reach for when alerting is not enough. Because policy and filtering are applied in eBPF in the kernel, Tetragon can enforce as well as observe, killing a process that violates policy rather than reporting it afterward. It is Kubernetes-aware, so policies reference workload identity instead of PIDs.

The tradeoff is operational weight. Enforcement means a bad policy can take down a legitimate workload, so most teams run it in observation mode first.

Posture and Compliance

Kubescape is CNCF incubating and reached v4.0.12 on August 12, 2026. It scans clusters, YAML manifests and Helm charts against CIS Benchmarks, NSA-CISA hardening guidance, MITRE ATT&CK and SOC 2, which makes it the tool that produces the artifact an auditor will accept. It also validates network policies and seccomp profiles, the two least-loved parts of Kubernetes hardening.

One genuinely new capability: Kubescape ships an MCP server that exposes its scan data to AI assistants, so you can ask a coding agent which workloads violate a control instead of parsing JSON. That is a practical use of MCP rather than a press release.

License: Apache-2.0 · Cost: free · Maintained by: ARMO

The Commercial Platforms

Wiz is now part of Google Cloud following the $32 billion close in March 2026, and it keeps its brand and multi-cloud support. Its argument is the security graph: it correlates a container CVE with cloud IAM and network exposure to tell you which of your 200 findings is actually reachable from the internet. That prioritization is the thing open-source scanners genuinely do not do.

Sysdig Secure licenses per host, with compute instances for posture management, and Aqua Security prices per node or workload tier. Neither publishes a rate card; both are quote-only, which tells you the target buyer has a procurement department. Sysdig's page says "prices tailored to your needs" and routes to a quote request.

Be honest about the decision here. You are not buying detection that Trivy and Falco cannot do. You are buying correlation, a support contract, and someone to call at 2 AM.

How to Wire Scanning Into CI

This is the highest-value hour of work in this article. Fail the build on new HIGH and CRITICAL findings that have a fix available, and ignore the rest until you have a triage process.

1. Scan locally first to see your real baseline. Trivy pulls from the registry directly, so no Docker daemon is needed:

Bash
Copy
# Vulnerabilities only, actionable severities
trivy image --severity HIGH,CRITICAL --scanners vuln node:18-alpine

# Dockerfile and IaC misconfigurations, including secrets in ENV
trivy config .

2. Add it to GitHub Actions. The ignore-unfixed flag matters more than any other setting, because failing a build on a CVE with no available patch teaches developers to ignore the scanner:

yaml
Copy
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@v0.36.0
  with:
    image-ref: 'docker.io/my-organization/my-app:${{ github.sha }}'
    format: 'table'
    exit-code: '1'
    ignore-unfixed: true
    vuln-type: 'os,library'
    severity: 'CRITICAL,HIGH'

3. Pin and update your base image. The 17-versus-zero result above was a base image choice, not a code change, and it is the single highest-leverage fix available.

4. Emit SARIF instead of a table once findings are under control, so results land in GitHub code scanning where they are reviewable rather than buried in CI logs. Set format: 'sarif' and upload with github/codeql-action/upload-sarif.

The first Trivy run takes about 50 seconds because it downloads the vulnerability database; cached runs are far quicker, and the database works offline afterward.

Related DevToolLab Tools

• Dockerignore Generator - Keep credentials, .env files and .git out of the build context so they never reach a layer a scanner has to find.
• Hex Viewer - Read an extracted image layer or an unknown binary as a hex dump and identify what it really is from its magic bytes.
• Kubernetes Secret Decoder - Decode base64 values in a Secret manifest to check what is actually mounted into a container.
• Docker Compose to Kubernetes - Convert a Compose file into manifests you can run Kubescape and the manifest linter against.
• Helm Chart Generator - Scaffold a chart, which is one of the three inputs Kubescape scans alongside live clusters and raw YAML.
• Best Static Code Analysis Tools - The source-code layer that runs before an image is ever built.
• Best Secrets Management Tools - Where the credentials should live instead of an ENV line in a Dockerfile.

Head-to-Head

How to Pick

Solo developer or side project. Trivy in CI, nothing else. Fail on fixable HIGH and CRITICAL findings and update your base image monthly. Total cost zero.

Small team shipping to Kubernetes. Trivy in CI plus Kubescape on a weekly schedule against the cluster. Add Falco in observation mode once you have someone who will actually read the alerts, because unread alerts are worse than none.

Already paying for Docker or Snyk. Use what you have. Docker Scout at Team tier or Snyk Container is enough, and consolidating tools has real value.

Regulated environment. Kubescape for the SOC 2 and CIS evidence, Trivy for scanning, Tetragon for enforcement where a control demands prevention rather than detection. This stack is fully open source and auditable, and you pay in configuration effort instead of license fees.

Large multi-cloud fleet with a security team. This is where Wiz, Sysdig or Aqua earn their price. When you have thousands of findings across several clouds, the correlation that tells you which twelve are reachable is the product.

Conclusion

The free tools cover the detection surface. Trivy finds the CVEs and the misconfigurations, Falco and Tetragon watch the kernel, and Kubescape produces the compliance artifact, all under Apache-2.0 with CNCF backing for three of them. What the paid platforms sell is prioritization and someone else's on-call rotation, which is a real product for a large fleet and an expensive habit for a small one.

Start with the cheapest thing that works. Run trivy config on your Dockerfile this afternoon, look at whether your base image is the one shipping 17 vulnerabilities, and get the CI gate to ignore-unfixed. That is an hour of work covering more ground than most container security budgets.

Versions, pricing and CNCF maturity levels were verified on September 2, 2026 and change frequently. Confirm current pricing with each vendor before making purchasing decisions.