Finding things
Container images
The base image each Dockerfile names, pulled and read, with nothing built.
From the Dockerfile, with no build
Every Dockerfile in the checkout is read for the image it starts from. Build arguments with defaults are resolved, stage aliases and scratch are skipped, and a reference still carrying an unresolved variable is left alone rather than guessed at. Each distinct image is pulled from its registry and read.
Why it matters
A container starts from a frozen copy of an operating system. Pin one in 2021 and you ship 2021's known holes today. This finds the four year old base image half an estate is still pinned to, and it needs nothing from anybody to do it.
What it does not do
Off by default, because it downloads images. It reads the base image the Dockerfile names, not an image you have already built and pushed. Snyk Container does both and tells you which base to move to.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.