docs(csm-vm): add code-to-cloud Dockerfile source linking section

[cyrbouchiat]

Summary

• Adds a new "Trace production vulnerabilities to source code" section to the Cloud Security Vulnerabilities overview page
• Explains how Datadog links CVEs detected on running container images back to the Dockerfile and commit that introduced the vulnerable package (code-to-cloud mapping)
• Cross-references the existing Link Dockerfile to vulnerabilities section in the CI/CD setup guide
• Adds two screenshots (light/dark) showing the Dockerfile preview panel in the vulnerability detail view

Context

This section is part of DASH preparation, making the code-to-cloud remediation workflow more discoverable from the main vulnerabilities page.

Test plan

• Verify the new section renders correctly between "Continuously detect..." and "Automation and Jira integration"
• Verify the [Link Dockerfile to vulnerabilities] link resolves to the correct CI/CD anchor
• Verify the screenshot displays correctly in both light and dark mode
• Verify the new further_reading entry appears in the "Further reading" section at the bottom

Made with Cursor

[github-actions]

Preview links (active after the build_preview check completes)

Modified Files

• https://docs-staging.datadoghq.com/cyril/csm-vm-dockerfile-source-linking/security/cloud_security_management/vulnerabilities/

[janine-c]

Looks great, thank you, Cyril! Just some very minor feedback, but nothing to get in the way of merging when we're ready.

[janine-c]

Suggested change

	When a CVE is detected on a running container image, Datadog can link it directly to the Dockerfile and commit that introduced the vulnerable package. This closes the gap between a production alert and the code change that caused it, giving developers the context they need to remediate at the source rather than chasing package versions across registries.
	When Datadog detects a CVE on a running container image, it can link the CVE directly to the Dockerfile and commit that introduced the vulnerable package. This closes the gap between a production alert and the code change that caused it, giving developers the context they need to remediate at the source rather than chasing package versions across registries.

Hopefully clarifies what "it" in "can link it directly" refers to?

[janine-c]

Docs don't use dark images, so you're good to remove this file 🙂

[janine-c]

This image seems to have gotten compressed somehow, so it's a bit blurry. It also shows a lot of the Ui, so it's hard to see which part is the relevant part of the page. I can help you make a more cropped version if you send me the URL, or maybe we don't need an image here?