Container image diffs: what do they tell teams about release risk?

TL;DR: Comparing two container image versions by digest and vulnerability set can separate fixed, introduced and persisting issues, turning scan output into release validation that shows what actually changed between builds, according to Anchore. The useful control is not raw scanning volume but diff-based evidence of risk reduction and remaining exposure.

Editorial analysis by NHI Mgmt Group, based on content published by Anchore: “Comparing Vulnerabilities Across Image Versions via the Anchore Enterprise API”.

Key questions

Q: How should teams validate whether a new container image actually reduced risk?

A: Compare the new image against the previous release using digests, not tags, and separate findings into fixed, introduced and persisting sets.

Q: Why do container scans need version-to-version comparison instead of a single snapshot?

A: A snapshot only shows current exposure, while version-to-version comparison shows what changed between releases.

Q: What do persisting vulnerabilities tell practitioners about their release process?

A: Persisting vulnerabilities show that a release did not eliminate issues that were already known, which usually means the problem is in remediation follow-through rather than detection.

Practitioner guidance

• Resolve image tags to digests before comparison Make digest resolution a required step in release validation so every comparison is tied to an immutable artifact rather than a mutable tag.
• Compare vulnerability sets across consecutive builds Use set differences to identify what was fixed and introduced, then use intersections to isolate findings that persisted through the release.
• Escalate persisted vulnerabilities with available fixes Route findings that remain present across versions into the next remediation cycle, especially when the newer image still exposes a fixable package.

Bottom line: Container image security becomes more actionable when teams compare releases by digest instead of relying on tags alone.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →