Vulnerability scanning
Turn on vulnerability scanning for your Container Registry to check images for known issues in OS packages and libraries on push, on request and every week.
Vulnerability scanning checks your images for known vulnerabilities in OS packages and libraries. It's off until you turn it on for your organization.
Turn it on
- Open Container Registry and find Vulnerability scanning.
- Select Turn on scanning. The confirmation shows the prices; confirm.
- In each repository's Settings, turn on Scan on push for the repositories you want scanned on every push.
Owners, admins and members who can manage the registry can turn it on.
When images are scanned
- On push, in repositories with scan on push.
- On request: select a tag and Scan now.
- Every week, each repository's newest tag is scanned again against the latest advisory data, so issues published after you pushed still show up.
A scan takes a minute or two.
Read the results
The repository list shows the counts by severity for each repository's newest tag. Select a tag to see each vulnerability with its CVE, severity, package, installed version and the version that fixes it. Rebuild the image on an updated base to pick up the fixes.
Turn it off
Select Turn off scanning. No new scans run and nothing more is billed; results of earlier scans stay visible, and queued scans are dropped.
Pricing
A number of scans each month are free. After that, each scan on push or on request, and each weekly rescan, is billed; failed scans aren't. The Vulnerability scanning card shows this month's scans, the free scans left and the cost so far. See your price list in the console for current prices.
For scanning your source code and dependencies before you build, see Code Security.
Related
Use with Pipelines and Kubernetes
Build and push images from Pipelines with registry infraista and no secrets, sign servers in before a deploy, and let Kubernetes clusters pull private images.
Repository settings
Set a repository's visibility, make tags immutable, add retention rules to delete old tags automatically, choose which clusters can pull, or delete it.