My nephew mentioned using Docker container security scanning tools for his cloud apps, but I have no idea how these scanners actually find vulnerabilities in the code.