Snyk Container Integration Guide

Integrate Snyk Container with Vulnetix. Use the Snyk CLI to scan container images for OS and application CVEs, export SARIF findings, and upload to Vulnetix.

Run Snyk Container in CI

Scan on every push and upload the report as a workflow artifact:

- name: Snyk container scan
  run: |
    npm install -g snyk
    snyk container test myapp:${{ github.sha }}       --sarif-file-output=snyk-container.sarif || true
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: snyk-container
    path: snyk-container.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Snyk Container's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Snyk Container. Keep running it. Vulnetix sits on top of Snyk Container (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Snyk Container is strongest at its core category and also carries features in SCA, SBOM Generation, IaC & Cloud Configuration, License Compliance, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Snyk Container does well

• Signature feature: base image upgrade recommendations that show which base image version fixes the most vulnerabilities
• Scans both OS layers and application dependencies with actionable, developer-first fix advice
• Curated Snyk vuln DB adds proprietary metadata (exploit maturity, EPSS/CVSS composite Priority Score)
• Generates CycloneDX and SPDX 2.3 SBOMs from images via the CLI

Where Vulnetix adds to it: Snyk Container is a best-in-class image scanner with base-image fix advice; Vulnetix does not replace it but ingests its findings and unifies them with every other scanner into one deduplicated, exploit-intel-prioritised queue with immutable versioned VEX + audit, EOL and SSVC policy on top.

No migration, no rip-and-replace. Snyk Container keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Snyk Container results in Vulnetix

Upload Snyk Container SARIF, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Snyk Container documentation ↗

Wire Snyk Container into your CI/CD pipeline →