# Prove Which Snyk Container CVEs Are Running in Production

Snyk Container identifies vulnerable image digests. Anyshift joins each digest to Kubernetes runtime, exposure, rollout history, owner, and remediation window.

Author: Roxane Fischer

Published: 2026-06-15T10:00:00-07:00

Source: https://anyshift.io/blog/annie-meets-snyk

[Snyk Container](https://docs.snyk.io/scan-with-snyk/snyk-container/how-snyk-container-works) (Snyk's container-image scanner) scans the final built image for installed packages and known vulnerabilities. The image can be checked without starting a container.

A scan can say `checkout-api` contains `CVE-2026-4172` (a public vulnerability identifier). It also gives an image digest: an immutable identifier for one exact image, such as `sha256:...` ([Docker docs](https://docs.docker.com/dhi/core-concepts/digests/)). Security still needs the runtime facts: is that exact image live in production, exposed to the internet, tied to a rollout, owned by a team, and still open?

In this example, Snyk flags `CVE-2026-4172` on `checkout-api`, image `registry.demo.local/checkout-api@sha256:checkout-prod-9f31`, in target `demo-retail/checkout-api`.

That image digest is the handoff. Anyshift looks it up in Kubernetes runtime, event history, cloud exposure, and ownership, then writes the verified fields back to the [Snyk Project](https://docs.snyk.io/snyk-platform-administration/snyk-projects) (the Snyk record for that scanned target) as attributes and tags.

The runtime data comes from Anyshift's event-based Kubernetes graph. It stores the live cluster topology and the changes behind it: pods, containers, services, ingresses, deployments, ReplicaSets, namespaces, owner references, and rollouts.

## Snyk Finding

Anyshift does not rely on the service name alone. It matches the Snyk image digest to the image digest on running Kubernetes containers.

## Runtime Evidence

Before Anyshift writes tags back to Snyk, it queries its Kubernetes graph for the runtime evidence behind each tag:

If no live pod has that digest, Anyshift leaves `live_prod` off. If the graph has no rollout event, it leaves arrival time and actor blank.

## CLI Review

## Snyk Update

![Snyk project overview for checkout-api, imported by CI/CLI with production, Backend, Critical, and Production attributes.](/images/blog/annie-meets-snyk-dashboard-project.png)

The Snyk project stays the triage surface. It shows the imported `checkout-api` target, the production reference, and the priority attributes. Anyshift writes the verified runtime fields back to that same project through the Snyk API: live production status, internet exposure, owner, rollout, actor, and open window.

The finding now carries both sides: vulnerable artifact and production path.

## Security Outcome

When triaging container CVEs, security can route on facts instead of severity alone:

- live or build-only
- prod or non-prod
- exposed or internal
- tied to a rollout or not
- open or already rolled back
- which owner should fix it

**A critical image finding becomes a runtime-backed remediation target.**

If your team uses Snyk and wants runtime-backed vulnerability routing, [contact us](/contact).