The container you ship is a stack. Your code sits on top of a runtime, system packages, and a base OS image you did not write. Most of the risk lives in those lower layers. Moolé x-rays every layer, works out the true base OS by looking at the filesystem, then ties each finding to what is actually running in Kubernetes. You get alarms on reachable, exposed risk, not on everything.
A container image is built in layers. Your application code is a thin slice on top. Underneath sit language libraries, system packages, and a full base OS. Every one of those layers ships in your image, and every one carries its own known flaws. When people say a container is "vulnerable," they usually mean the base is, not the code the team wrote. Here is where the CVEs actually live.
Two of these findings came from code your team wrote. The other fifty came with the base image and the packages layered on top. Scan only your code and you miss where the risk really is. Moolé reads every layer, so nothing beneath your code hides from view.
Most tools scan your code.
Moolé scans everything under it too.
Moolé opens the image, reads every layer, and works out what it is actually made of. Then it looks at your cluster to see which parts are exposed and reachable. A flaw in a package no running pod uses is not the same as one on your front door, and Moolé tells the two apart.
Reads every package across all layers of the image, not just the top one. Connects to your registry directly: Amazon ECR, Google Artifact Registry, Docker Hub, Azure Container Registry, and Nexus.
Identifies the true base OS by looking at the filesystem, not by trusting a label. If a base image quietly changes from one build to the next, Moolé catches the drift.
Maps each vulnerability to the pods and namespaces actually running it. Findings on code paths no running workload reaches drop out of the way.
Watches for poisoned images and dependency-confusion attacks, where a bad package slips in by matching the name of one you trust.
Produces an image-level bill of materials in SPDX or CycloneDX, tied to the exact image digest so you always know what a given build contained.
Guardrails written once and applied the same way every time, with scoped exceptions that carry an expiry date so temporary waivers do not become permanent.
A container does not stop changing when the build ends. It moves from a base image through your pipeline into a registry, then into the cluster, then into production traffic. Moolé watches the same image at every stop, and enforces at the point where a bad build should not be allowed to move forward.
Moolé tracks the same container end to end, so a change slipped in outside CI/CD, a swapped base image or a hand-patched layer, does not go unseen. Enforcement lands at the registry, where a failing image can be stopped before it reaches the cluster.
A gate that fails every build on every CVE gets turned off within a week. Moolé fails a build only when a finding breaks policy and carries real, reachable risk. Everything else is recorded, ranked, and left for you to handle on your own schedule.
Fail-build only on policy-breaking, reachable risk. The gate stays trusted because it fires when it should, so teams keep it on instead of routing around it.
One picture of container risk across every repo and team, so a base image with a serious flaw is visible everywhere it is used, not one project at a time.
Reporting mapped to the frameworks auditors ask about: CIS, NIST, PCI, SOC 2, and HIPAA. The evidence is ready when the request lands.