A method of container and image scanning includes receiving, by a processing device initiating a scan process to scan containers executing functionality of multiple applications. The method further includes, for each container of the containers, identifying portions of an application image instance of the container, the portions corresponding to previously-scanned clean layers of the application image instance, scanning, by the processing device in accordance with the scan process, remaining portions of the application image instance not associated with the previously-scanned clean layers, and responsive to a clean result of the scanning of the remaining portions of the application image instance, terminating, by the processing device, the scan process for the container and allowing the container having the application image instance to execute.