The layer your code scans don’t seeYou already verify the code you write and the dependencies you import in SonarQube. The images you ship add another layer: operating system packages, language runtimes and libraries that never appear in your repository. Teams often check that layer in a separate tool and end up with a second set of findings to reconcile.
SonarQube container scanning is now in open beta
About this summary. This is a short excerpt from the description that Sonar published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.sonarsource.com/blog/container-scanning-open-beta/

Source attribution: headline and facts are from Sonar (sonarsource.com). Summary method: excerpt of the source description. See our source attribution policy.





