How We Blocked Vulnerable Docker Images Before Production With Trivy and OWASP
Business Challenge
A healthcare SaaS provider on Azure AKS faced critical security alerts after vulnerable Docker images reached production due to a lack of pre-deployment scanning.
Tech Stack
Blueprint
The DevOps team enhanced the Azure DevOps pipeline by embedding OWASP Dependency Check and Trivy to scan application dependencies and container images. Builds now undergo automated scans for dependencies and container images, approval gates block high-risk vulnerabilities, and Azure Monitor provides constant monitoring.
The Client
But inside the pipeline, a critical weakness went unnoticed. With no automated security checks in place, every release carried the risk of deploying vulnerable Docker images.
The vision was clear. The process needed control.
The Challenge
Key issues included:
- No image or dependency scanning before deployment
- No automated approval gates to prevent vulnerable code from shipping
- A reactive response process with security tools flagging vulnerabilities only after production deployment.
Why Bobcares
The critical gaps between deployment speed and security readiness showed that the client needed a partner who could deliver more than technical fixes. A team capable of embedding security deep into the CI/CD pipeline was essential to ensure every release remained clean and compliant.
Bobcares was chosen for expertise in Azure DevOps, container security, and pipeline automation. The goal was clear:
- Integrate security scanning at every stage of the pipeline
- Establish standardized checks for images and dependencies
- Guarantee that no container image would reach production without a verified clean scan report
What We Delivered
Discovery & Analysis
The process began with a full audit of the Azure DevOps pipelines, reviewing build and release stages for both backend and frontend workloads. Every build step, every dependency, every image path was mapped to uncover weak points and risks.
Designing the Framework
Trivy was selected for image and infrastructure scanning and OWASP Dependency-Check for application-level vulnerabilities. Together, these tools delivered full coverage across code, images, and configurations.
Building the Pipeline
- Pre-build scans checked application dependencies, automatically blocking builds if high-severity CVEs were found
- Post-build scans analyzed the Docker image, ensuring updated secure base images were always used
- Scan reports were generated, archived in Azure Blob Storage, and integrated into monitoring dashboards
- Approval gates ensured no build could advance to production without a clean report
- Weekly summaries were delivered to both DevOps and security teams, keeping everyone aligned
The Launch
The Results
Metric |
Before |
After |
| Vulnerabilities detected in production | Yes | Zero |
| Deployment approval process | Manual & reactive | Dev ENV Automated & manual in UAT & PROD |
| Time to detect vulnerabilities | Post-deployment (hours/days) | Pre-deployment (minutes) |
| Security tool coverage | None pre-deployment | 100% builds scanned |
The Business Impact
- Zero vulnerabilities flagged post-deployment
- Instant detection of high-risk CVEs in minutes, not days
- Automated approval workflows across environments
- Complete visibility through centralized Azure dashboards
- A development team educated and engaged in maintaining secure pipelines
What’s Next
The next phase focuses on strengthening security coverage across the entire environment. The plan includes integrating Trivy’s Kubernetes cluster scanning for real-time monitoring of AKS workloads, extending vulnerability checks to Infrastructure-as-Code templates such as ARM, Bicep, and Terraform, and implementing Dependabot to automate library updates alongside OWASP checks for continuous protection.
Where It Comes Together
This was about building a secure, repeatable process that supports growth without sacrificing control. Bobcares delivered clear visibility, predictable pipelines, and a foundation trusted for every future deployment.
