Scan Docker Image locally

Assuming you have a .env file at the root of your repo (see .env.example):

FITNESS_TRACKER_DATA_DIR=data
FITNESS_TRACKER_ATHLETE=default

Build the image (env vars are injected at runtime, not build time):

docker build -t fitness-tracker:latest .

Then scan with Grype:

grype fitness-tracker:latest

Scanning also runs automatically in CI via job_docker_image.yml using Anchore scan-action. Builds fail on HIGH or CRITICAL severity findings.