Now, you can let Google automatically take care of your base image, but you're still on the hook for securing the other layers. Luckily, Google has made detecting issues in your images easier by providing a service called Container Analysis. Google Container Analysis can perform vulnerability scans on your Linux amd64 images. Container Analysis supports both automatic scanning, via the Container Scanning API, and manual scanning, via the On-Demand Scanning API. You're billed for every scanned image, so you can choose the method which best suits your needs.

Automatic scanning performs vulnerability scans on container images stored in either Artifact Registry or Container Registry. Once enabled, every time you push an image, a scan will be triggered. Now, scans happen only once based on the images digest. That means that adding or modifying tags will not trigger new scans, only changing the contents of the image will.

Vulnerability information is continuously updated for up to 30 days whenever new vulnerabilities are discovered, so you don't need to constantly rescan your images every day to identify new defects. After 30 days, images are considered stale and the metadata is no longer updated.

Now to extend the monitoring window, you'll need to push the image again, and it is possible to automate re-pushing containers every 30 days, if you desire. With On-Demand Scanning, you can manually scan images in the Container Registry, Artifact Registry, or even locally on your own machine. Results are available for up to 48 hours after the scan is complete.

Unlike automatic scans, this will not continuously monitor and notify you of newly discovered vulnerabilities. However, it is useful for when you desire full control over what images are scanned and when. It also can be used for scanning images locally before committing them to them a registry. 

Now, when the scan of an image is complete, a list of detected vulnerabilities is generated. This list includes the name of the package that contains the vulnerability, the severity, from critical to minimal, and whether a known fix is available. All results are stored as metadata, which can be accessed via API and also can be used to make decisions during your deployment process. The database for Container Analysis is continuously updated, every time a new security threat is identified. So even if an image came up clean in the past, a new update might now flag it as compromised.

Now, Container Analysis won't detect every single possible security issue. As I said, it currently only supports Linux-related issues on the amd64 platform. Windows containers are not covered. But it can be an easy and effective way to identify the most common security problems.