Docker Base Image EOL Check vs. a Vulnerability Scanner
Related tools, different questions. A vulnerability scanner like Trivy, Grype, or Docker Scout tells you which CVEs are already known and present in your image's installed packages -- it needs the image pulled or built. This checker reads only the FROM line's text and answers a narrower, upstream question in your browser: has that release line itself passed its publisher's own end-of-life date, whether or not a CVE has been filed against it yet.
What each tool is for
A vulnerability scanner pulls or builds your image, enumerates the packages actually installed inside it (OS packages, language dependencies, sometimes application libraries), and matches each one against CVE feeds and vendor advisories. It is broad and grounded in what is really in the image -- exactly the right tool for "what known vulnerabilities does this image currently contain." Running one needs the image itself and a maintained vulnerability database.
This checker does one narrower thing, straight from the text of a Dockerfile: it reads
each FROM line's image and tag, and checks the release line they name against a small, dated
end-of-life table -- no pull, no build, no CVE database. It catches a case a scanner structurally cannot:
a base image with zero currently-known CVEs that is still past end-of-life, because a clean scan only means
nothing has been matched yet, and nobody is looking for new issues in an unsupported release line
the way they are for a supported one.
| Question | Where to answer it |
|---|---|
| What known CVEs are present in the packages actually installed in my built image? | A vulnerability scanner -- that is its entire job, and this tool does not attempt any of it. |
| Has my FROM line's release line itself passed its publisher's end-of-life date? | This checker -- straight from the Dockerfile text, no build or pull needed. |
| My scanner reports zero CVEs for this image -- am I safe? | Not necessarily: a clean scan means nothing known has been matched yet, not that the release line is still receiving fixes. Check this tool too. |
| I want a pre-build check I can run at the same stage as a linter, before CI builds the image. | This checker -- it needs only the Dockerfile text, so it runs earlier in the pipeline than any scan of the built image can. |
The two are complementary, not competing: a pipeline can run this checker as an early, cheap gate on the Dockerfile itself, then a vulnerability scanner on the built image for the CVE question this tool does not attempt.
Common questions
Should I use this checker or a vulnerability scanner like Trivy?
Different shapes of tool for related but different questions. A vulnerability scanner pulls or builds your image, inspects the packages actually installed inside it, and matches each one against CVE databases -- broad, accurate about what is really there, and it needs the image itself. This checker reads only the Dockerfile text and answers one narrower, upstream question: has the release line named by the FROM tag itself passed its publisher's own end-of-life date. It needs no pull, no build, and no CVE database, and it catches the case a scanner cannot: a base image with zero currently-known CVEs that is still unsupported, because nobody is looking for new ones on it anymore.
If Trivy finds no CVEs, does that mean the base image is still supported?
No, and this is the exact gap this tool exists to close. A scanner reports CVEs that are known and matched in its database as of the scan. A base image release line that has passed end-of-life is not necessarily full of already-known CVEs -- it may show a clean scan today and still be a release nobody is patching, so the next vulnerability discovered in it will never be fixed upstream. A clean vulnerability scan answers 'what is already known to be wrong,' not 'is anyone still going to fix what gets found tomorrow.'
Why would I need this if I already run a scanner in CI?
Speed and a different question, not a replacement. A scanner needs the image built or pulled, which in CI means after your build step; this checker reads the Dockerfile text alone and can run before you even build, catching an end-of-life base image at the same review stage as a linter. It is also the more direct answer to a specific worry -- 'is this release line still supported at all' -- when the scanner's dozens of CVE rows do not directly say so.
Is this page affiliated with Trivy, Grype, or Docker Scout?
No. This site is not affiliated with, endorsed by, or sponsored by Aqua Security (Trivy), Anchore (Grype), or Docker, Inc. (Docker Scout). They are named here only to describe what this checker is and is not, using publicly documented facts about how each tool works.