Container Reachability

Fix only the container vulnerabilities that actually run

Container Reachability tells security and platform teams which container vulnerabilities are actually exercised by the running application, cutting container vulnerability noise by up to 90% — without sidecars, agents, or a forced migration to restricted base images.
Book a Demo
Start Free Trial
Diagram comparing simple manifest scanning to Endor Labs container reachability with two cylinders. The left cylinder labeled 'Simple Manifest Scanning' contains all vulnerabilities. An arrow labeled 'Container runtime analysis' points right to the cylinder labeled 'Endor Labs Container Reachability,' which is divided into reachable vulnerabilities at the top and unreachable ones below.
Loved by security teams, painless for developers at:

How Container Reachability works

Cut container noise without giving up your base images
Studies show 96% of public container images contain vulnerabilities and 91% include at least one critical or high finding, most in OS packages the application never loads. Container Reachability identifies what actually runs, so teams cut noise without migrating to restricted images that add friction and lock-in.
Prove which findings really need remediation under a tight SLA
FedRAMP and similar frameworks require documented remediation of every reachable vulnerability within 30-day windows. Runtime evidence lets teams defensibly deprioritize unreachable findings and collapse overlapping SCA and container tickets into one fix.
Prune and upgrade base images with confidence
Platform teams own base and golden images but get no signal on which OS packages downstream applications actually use. Application-scoped reachability shows exactly what's loaded, so teams can prune and upgrade without breaking the apps built on top.
“Over 97% of vulnerabilities flagged by our previous tool weren't reachable in our application. Endor Labs shows the few impactful vulnerabilities, so we can patch quickly, focusing on what matters.”
Travis McPeak
Travis McPeak

Security Lead, Cursor (Anysphere)

Diagram showing two connected cylinders labeled Application Reachability and Container Image Reachability converging into Full Stack Threat Analysis with the subtitle one reachability model across application code and container images.
Full-stack reachability
Container Reachability extends Endor Labs' reachability analysis from application code down through the runtime and OS layers, classifying every OS package as Reachable, Potentially Reachable, or Unreachable.
Know which OS packages and shared libraries your running application loads versus which sit dormant on disk.
Eliminate 50–90% of container findings as unreachable on real-world images.
Cover Debian, RPM, and Alpine ecosystems on the same dependency graph that powers Endor Labs' application SCA.
Learn more
Audit-ready evidence
Runtime evidence gives you a defensible, deduplicated basis for prioritization that holds up under FedRAMP and audit scrutiny.
Defensibly deprioritize unreachable container vulnerabilities under FedRAMP's 30-day remediation windows.
Deduplicate findings across application SCA and container scans so each vulnerability is one ticket and one fix.
Block builds on reachable findings and let unreachable ones through with policy, not blanket enforcement.
Learn more
Dashboard screen for nginx latest version with tabs Overview and Reachability Analysis. Overview shows two circular charts: Dependencies with 152 total (24 reachable, 127 unreachable, 1 unknown) and Findings with 388 total (8 critical, 79 high, 239 medium, 62 low). Details below: Dependencies Visibility - 0 Public, 152 Private; OSS Dependencies - 0 Direct, 0 Transitive; Dependencies Scopes - 0 Build, 0 Test, 152 Unspecified, 0 Normal; Dependents - 0 Direct, 0 Transitive.
Diagram showing an Application Container Image feeding into an Endor Sandbox, which performs runtime analysis of memory and file activity, alongside a user interface panel for nginx @latest with statistics on dependencies and findings categorized by reachability and severity, plus metadata on project name, resolution time, and package version UUID.
No-agent profiling
Application-scoped runtime evidence is collected without touching production, and it feeds safer base-image maintenance over time.
Deploy without sidecars, daemonsets, or production agents — profiling runs in a sandbox or CI environment.
Identify which OS packages downstream applications use before pruning or upgrading a shared base image.
Aggregate reachability across application images to inform the design of cleaner golden images.
Learn more
Book a Live Demo
Flowchart showing integration paths from GitHub, GitLab, and PHP to Slack and Microsoft platforms, with a C# icon connected to Slack.

Your Tools, Your Languages
— All Secured

Learn how Endor Labs fits into your ecosystem.
Learn More
Flow diagram connecting software development tools and platforms including .NET, JetBrains, GitHub, Google, and Vercel.

Related Resources

Introducing Full Stack Reachability: Container Scanning That Actually Reduces Noise
Introducing Full Stack Reachability: Container Scanning That Actually Reduces Noise
Read the blog
Achieving FedRAMP’s Container Scanning Requirements
Read the blog
Container Scanning + SCA = Better Together
Container Scanning + SCA = Better Together
Read the blog

FAQs

How is this different from a normal container scanner?

Traditional scanners enumerate every installed package and treat all findings equally, producing hundreds of vulnerabilities per image with no signal for which ones run. Container Reachability combines a static container dependency graph with dynamic runtime profiling to classify each OS package as Reachable, Potentially Reachable, or Unreachable.

How much noise does it actually remove?

Across real-world open-source images, 46–90% of reported vulnerabilities were associated with unreachable OS packages — roughly 78% for nginx, 75% for Redis, and up to 90% for lightweight Alpine-based images.

Do I need to install agents or sidecars?

No. Profiling runs inside the container using a lightweight wrapper in a sandbox or CI environment — no sidecars, daemonsets, or persistent production agents. For images that need specific secrets or orchestration to start, an optional instrumented wrapper image can run in staging environments like Kubernetes or ECS.

Will this satisfy FedRAMP and other auditors?

Runtime evidence lets you defensibly deprioritize unreachable findings under tight remediation SLAs and document why each finding was prioritized or deferred. It also deduplicates overlapping SCA and container findings so one vulnerability produces one entry, not two.

What about my language dependencies like npm or pip?

Container Reachability covers OS-level packages; language-specific packages are analyzed by Endor Labs' existing SCA, so each layer is handled with the technique built for it.

Does it handle statically linked binaries?

Yes. A statically compiled Go application may ship glibc in the image but never load it, and reachability analysis correctly marks such libraries as unreachable.

Code without compromise

Book a Demo
Start Free Trial