Software Supply-Chain Security of Containerized IoT Components for Sustainable Energy Systems: A Comparative Vulnerability Assessment Using Trivy and Grype

The digitalization of sustainable energy systems increasingly relies on containerized Internet of Things services deployed across cloud–edge architectures. These services introduce software supply-chain risks associated with public container images and their dependencies. This study evaluates 22 container images representing 13 official or vendor-maintained technologies used for data storage and processing, communication, proxy and API services, and application runtime environments. Each image was analysed using Trivy and Grype, resulting in 44 vulnerability scans performed using vulnerability databases available on 14 June 2026. The effect of image minimization was assessed using five strictly matched standard–minimized pairs, while scanner agreement was evaluated for all images using unique CVE sets, the Jaccard coefficient, and symmetrical and directional Tversky indices. Across the complete sample, Trivy reported 7006 vulnerability findings and Grype reported 2299. Within the strictly matched sample, findings decreased from 5181 to 193 for Trivy and from 982 to 290 for Grype. However, these reductions were strongly influenced by the Ruby image, and the exact Wilcoxon signed-rank test did not confirm a statistically significant general minimization effect (p=0.250). Redis, HAProxy, and Ruby showed substantial reductions, whereas Caddy remained unchanged and both .NET SDK variants produced zero findings. The set-based analysis revealed incomplete and asymmetric agreement between the scanners, demonstrating that similar aggregate counts may represent different CVE profiles. Operational prioritization of six selected image variants further showed differences in remediation availability, EPSS scores, and CISA KEV inclusion. The results indicate that image minimization can reduce scanner findings but does not independently confirm container security. A multi-tool DevSecOps process combining immutable digest verification, Software Bills of Materials, vulnerability prioritization, image rebuilding, and continuous rescanning is therefore recommended.