Security Scanner

Scan the container images your workloads run for known vulnerabilities (CVEs) and triage what matters.

How it works

Kubexer uses Trivy under the hood. The first time you scan, the Trivy binary is downloaded on demand and verified by SHA-256 checksum before it runs.

1. From a Pod or Deployment drawer, choose Run security scan.
2. Kubexer resolves the image(s) from the workload's pod template — a Deployment scans every image it runs.
3. Results are stored locally and presented as a parent scan with per-image findings.

Triaging findings

• Findings are grouped by image and severity.
• Each CVE links to its advisory so you can judge impact and available fixes.

Private registries

If a workload uses imagePullSecrets, Kubexer wires those credentials into a temporary Docker config for the scan, so private images scan just like public ones.

Notes

Security Scanner is a Pro feature.