Scan Docker Image locally

Assuming you have a .env file at the root of your repo (see .env.example):

USER=<USER>
ATHLETE=<ATHLETE>
EMAIL=<EMAIL>
GOOGLE_DRIVE_DATA_PATH=data

Build the image (env vars are injected at runtime, not build time):

docker build -t fitness-tracker:latest .

Then scan with Grype:

grype fitness-tracker:latest

Scanning also runs automatically in CI via job_docker_image.yml using Anchore scan-action. Builds fail on HIGH or CRITICAL severity findings.