.svg)
Operate · Container images
Fix the image vulnerabilities that actually run, at the source.
Heeler scans the images your registries hold and your workloads run, and ties each to its repository and team.
See inside every image you run.
Layer by layer, down to the step that added it.
payments-api · running in ECS · production
- Base
FROM node:20.11-alpine3.19openssl · CVE - Yours
RUN npm cilodash 4.17.20 - Yours
COPY . /appAWS key
Running images found and scannedLinked to repo and teamSBOM: SPDX or CycloneDXECR · Artifact Registry · ACR
OS and app packagesEnd of supportSecrets, with the layerVendor VEX honored
payments-api · Amazon ECR
- Vulnerable package in the image
- Most tools stop here
- In useECS service
- Internet accessible
- Tier 1 · Production
URGENTFix within 14 days
Runs only outside production? Fixed after the Urgent ones.
Fix at the source
The right fix for the layer it came from.
payments-api → acme/payments-api · @payments-team
- Base layersBase upgrade PR
- node:20.11 → 20.18-alpineFewest CVEs
- Your layersTo the owning team
Closed in production, on the owner's SLO
Done when the old image stops running.
- In UseVulnerable digest
- RebuiltNew digest ships
- RetiredOld image out of use
@payments-teamSLO 14 days
Prevent
Stop vulnerable packages before they ship.
More in Operate
