Container Image Vulnerability Triage
Prioritise scan results sensibly.
Added October 15, 2026. Written with AI assistance and checked for clarity and placeholders; not reviewed by a lawyer, accountant, clinician or other professional. How these prompts are made
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
Triage the vulnerability scan results of my container image. Scan output, summarised: [SCAN_OUTPUT]. What the image does and where it runs: [IMAGE_CONTEXT]. Exposure (internet-facing, internal only): [EXPOSURE]. Group findings by whether the vulnerable component is reachable and used in this image, whether a fix exists, severity, and exposure. Create a prioritised table with Finding | Package | Reachable? | Fix available | Priority | Action | Target date. Explain the reasoning for deprioritising anything and mark assumptions to confirm. Provide an approach for reducing findings structurally: smaller base images, removing build tools from runtime images, and rebuild cadence. Define an exception process with expiry for accepted risks. This is for images I operate; do not provide exploit instructions. Add a communication template for reporting the triage outcome to stakeholders in plain language, a measure of mean time to remediate by severity, and a monthly report format. Explain how to treat vulnerabilities in packages that are present in the image but never loaded, and how to document the evidence for that claim so that it can be checked by someone else.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into Any AI or another assistant.
See an example result (fictional data)
Finding | Package | Reachable? | Fix available | Priority | Action | Target Critical RCE | libfoo | No (not loaded) | Yes | Medium | Rebuild with patched base | 14 days High | openssl | Yes | Yes | High | Update base image | 3 days Medium | tar | Yes | No | Low | Remove package from runtime image | 30 days Reasoning: the first is not loaded at runtime; evidence: the package is installed for the build only (confirm). Structural: smaller base, multi-stage build, weekly rebuild. Exception: accepted risks expire after 60 days.
Illustrative only, made-up data. Your results will differ and must be reviewed.