---
title: "Scan a project, repository, or artifact"
description: "Scan Container Registry images for known vulnerabilities, read the findings, and keep vulnerable images from being pulled."
content_type: "how-to"
product: "container-registry"
platform: "MyAccount"
url: "/myaccount/container-registry/how-to/scan-a-project-repository-or-artifact/"
topic: ["security-and-access"]
relationships: {"requires":["/myaccount/container-registry/how-to/create-a-registry-project/"]}
---

# Scan a project, repository, or artifact

Every image is scanned for known vulnerabilities automatically when you push it. Scan again whenever
you want fresh results: a whole project, one repository, or a single artifact. The results show on
each artifact, and you can keep images with vulnerabilities from being pulled.

## Before you begin

Scanning needs a registry project with at least one image pushed to it and, if you are a team
member, a role with the create, update, or delete permission for Container Registry. See [Push and
pull images](/myaccount/container-registry/how-to/push-and-pull-images/).

## Scan a whole project

In MyAccount, under **Storage**, click **Container Registry**. In the project list, open your
project's **Actions** menu and click **Scan**. The scan starts with **Project Scan Started.**,
covering every artifact in every repository of the project.

## Scan a repository

In MyAccount, under **Storage**, click **Container Registry**, and click your project. On its
**Repositories** tab, open the repository's **Actions** menu and click **Scan**. The scan starts
with **Repository Scan Started.**, covering every artifact in the repository.

## Scan one artifact

1. In MyAccount, under **Storage**, click **Container Registry**, and click your project. On its
   **Repositories** tab, click the repository's name. Its **Info** tab lists the artifacts.
2. Open the artifact's menu and click **Scan**. **Scan Started** confirms it.

**Scan** is in an artifact's menu once its last scan has finished or was stopped. An artifact with
no scan result has only **Delete** in its menu, so scan its repository or its project. While a scan
is queued, running, or failed, the menu has **Stop Scan** instead; clicking it shows
**Scan Stopped**.

## Read the results

On the repository's **Info** tab, the **Vulnerabilities** column shows each artifact's result:

- `<n> Total <n>-Fixable`: the scan finished, with the number of vulnerabilities and how many of
  them have a fix. An artifact with no vulnerabilities reads **0 Total 0-Fixable**.
- **Scanning** or **Queued**: the scan is running or waiting to run.
- **Scan Stopped**: the scan was stopped. Scan the artifact again to get a result.
- **Not scanned**: the artifact has no scan result. Scan its repository or its project.
- **Scanner Not working**: contact support with the project's name and the repository.

The repository's **Vulnerability** tab lists the vulnerabilities of the first artifact in the list,
with their **Vulnerability**, **Severity**, **CVSS3** score, **Package**, **Current version**, and
**Fixed in version**. Each vulnerability's name links to its details, and opening a row shows its
description. To fix a vulnerability, rebuild the image with the package at its **Fixed in version**
or later, and push it again. With no vulnerabilities, the tab says
**Currently No Vulnerability are there in this artifact.**

## (Optional) Keep vulnerable images from being pulled

Vulnerability prevention stops images with vulnerabilities at a chosen severity and above from being
pulled; an image with no vulnerabilities at that level still pulls.

1. In MyAccount, under **Storage**, click **Container Registry**, click your project, and open its
   **Configuration** tab.
2. Under **Deployment security**, check **Prevent vulnerable images from running.** to turn
   prevention on, or clear it to turn prevention off. While it is checked, choose the
   **Severity Level**: **Critical**, **High**, **Medium**, **Low**, or **None**. The further down
   the list you choose, the more images are stopped: **Critical** stops only images with critical
   vulnerabilities, and **None** stops every image with any vulnerability.
3. Click **Save**.

The project's configuration is updated. With prevention on, the project list reads **Prevent images
with vulnerability severity of <level> and above from being deployed.** Turning prevention off sets
the level to **None**, and the list reads **Deployment Security disabled**. With prevention off, the
level has no effect, and every image pulls.

Your images now carry their scan results. To run them on Kubernetes, see
[Pull images from a Kubernetes pod](/myaccount/container-registry/how-to/pull-images-from-a-kubernetes-pod/).
If a pull fails with 412 after you turn prevention on, see
[Troubleshooting Container Registry](/myaccount/container-registry/troubleshooting/container-registry/#docker-pull-fails-with-412).
If **Scan** is not available, see
[Troubleshooting Container Registry](/myaccount/container-registry/troubleshooting/container-registry/#scan-is-not-available-for-an-artifact).