Container AI Analysis

After a container scan, Vygl runs a one-shot AI analysis that produces a markdown summary: overall risk posture, the few CVEs worth fixing first, and base-image guidance when an upgrade would materially reduce inherited vulnerabilities. The result is cached against the image’s open-finding state, so re-scanning the same image with the same findings returns the cached analysis instantly.

What the summary covers

A typical Container AI Analysis has four sections:

Section	Content
Overall risk	A short paragraph framing the image’s posture — high/medium/low risk and why.
Priorities	The 3–5 specific CVEs or packages that should be addressed first, with reasoning.
Base image guidance	When the base layer carries a meaningful share of the image’s CVEs, a callout describing the impact of upgrading. The summary names the impact, not a specific target image — confirm a concrete upgrade target before swapping.
Remediation steps	Practical next steps — base-image upgrade, package upgrade, removal of unused packages, layer reordering.

Caching

The analysis is keyed on a hash over the image’s open-finding fingerprints. Re-scanning the same image returns the cached sections blob — no LLM call. New findings (or a digest change that brings new findings) invalidate the cache and trigger re-analysis.

Streaming endpoint

If you’d rather see the analysis token-by-token (in the AI Consultation chat or programmatically):

GET /containers/images/ai-analysis/stream?image_ref=...&force=false

Returns a Server-Sent Events stream with each section as it generates. Pass force=true to bypass the cache and re-run the LLM unconditionally.

How prioritization is computed

Before calling the LLM, Vygl pre-aggregates findings into a structured summary — severity counts, fixable counts, top vulnerable packages, OS vs application split, trend delta from the previous scan. The model works from this summary plus a fingerprint of the worst findings, not from a raw 200-finding table. This keeps the input small enough to fit in token budgets while still giving the model the data it needs to prioritize.

Base-image guidance is advisory

Vygl flags the impact of a base-image upgrade but does not currently propose a specific target image. Always validate that your candidate upgrade actually maintains compatibility with your application before swapping — runtime libraries and entrypoints can shift between minor versions of the same distro.

Source correlation isn't yet wired into the analysis

The analysis does not yet weight findings by source ↔ container correlation. A CVE that’s clearly reachable from your code is treated the same as one in an unused base-image package. This is on the roadmap.