CI/CD Advanced CICD-1199 · 25 min

Container image scan passes on build but release still ships an older vulnerable tag

The current build artifact is scanned successfully, yet the release pipeline promotes a different tag or digest that was never covered by the scan result.

Pro

시나리오

Community advice added image scanning to the build stage. Security still finds a vulnerable image …

구독하면 이어서 볼 수 있어요

이 문제의 전체 시나리오와 점검 체크리스트, 복구 순서, 모범 풀이는 Pro 구독에서 열립니다.

구독 안내 보기

내 풀이

저장됨

1 · 원인 분석 2 · 복구 방안 3 · 재발 방지

풀이 기록·힌트·북마크는 로그인하면 계정에 저장되어 웹·앱에서 이어집니다.

Container image scan passes on build but release still ships an older vulnerable tag

Buildx push succeeds but downstream deploy still uses an older digest

Container registry login succeeds but build still pulls anonymously

Concurrency cancellation leaves a half-finished promotion state in the release path

An Argo CD sync is green and one deployment still loads the wrong image