Six defects, one scanner: which ones does trivy config see? (Week 13)

Fix the defects in Dockerfile.insecure one at a time (the fixes are the lines from Dockerfile.hardened) and watch trivy config re-score the file. The rules are Trivy 0.76.1's, checked against a real scan of every combination below — nothing is sent anywhere.

harden.md rows — fix each one

1 Base image CWE-1104 · CWE-16

2 Remove the secrets from ENV CWE-526 · CWE-798 · CWE-200 3 Copy only what the app needs, not COPY . . CWE-538 4 Drop chmod -R 777 CWE-732 5 Add USER 65532:65532 (non-root) CWE-250 6 Pinned install in a venv, --no-cache-dir CWE-1104 Drop the --severity filter (show LOW too)

Six defects, one scanner — which ones does Trivy see?

harden.md rows — fix each one

The file Trivy scans

trivy config output

Still in the file — no rule fires