Container Images
The artifact you actually deploy is where the real risk lives. Even if your source is clean, the OS packages pulled in by the base image or the image configuration can be vulnerable. Register the built container image as is, and check known vulnerabilities (CVEs), the component list (SBOM), and image hardening violations together in one service.
Analyses available for this type
| Analysis | What it finds |
|---|---|
| Image SCA | Known CVEs in OS packages and app dependencies |
| SBOM · Hardening | Component list and image configuration best-practice violations |
Registration methods
There are two methods.
- Registry image : Point to an image in a registry such as Docker Hub or Harbor. Private registries require credentials.
- Image upload : Directly upload an image tar file created with
docker save. Useful in environments where the registry is not reachable.
Registry authentication
Private registries require a username/password (or token). Stored credentials are shown masked, and if you do not re-enter them when editing, the existing values are kept.
Registration steps
- On the [Services] page, click Register service and select Container image.
- Enter the registry image reference (for example,
harbor.example.com/team/app:1.2.0) or upload an image tar. - Select the analyses to run (SCA, SBOM, hardening).
- Once registered, the first scan starts automatically.
Tags and rescans
When a new tag of the same image is released, you can register again or rescan to compare with previous results. New CVEs are also detected through continuous monitoring, which raises an alert. (Security News)
Next steps
Turn on analysisImage SCAKnown CVEs in OS packages and app dependenciesTurn on analysisSBOM · HardeningComponent list and image configuration violationsUse the resultsVulnerability managementReview findings, mark false positive/accepted riskUse the resultsSecurity NewsContinuous monitoring alerts for new CVEsReferenceSBOM uploadAnalyze an already-built SBOM only