Scan a project, repository, or artifact

Every image is scanned for known vulnerabilities automatically when you push it. Scan again whenever you want fresh results: a whole project, one repository, or a single artifact. The results show on each artifact, and you can keep images with vulnerabilities from being pulled.

Before you begin

Scanning needs a registry project with at least one image pushed to it and, if you are a team member, a role with the create, update, or delete permission for Container Registry. See Push and pull images.

Scan a whole project

In MyAccount, under Storage, click Container Registry. In the project list, open your project’s Actions menu and click Scan. The scan starts with Project Scan Started., covering every artifact in every repository of the project.

Scan a repository

In MyAccount, under Storage, click Container Registry, and click your project. On its Repositories tab, open the repository’s Actions menu and click Scan. The scan starts with Repository Scan Started., covering every artifact in the repository.

Scan one artifact

1. In MyAccount, under Storage, click Container Registry, and click your project. On its Repositories tab, click the repository’s name. Its Info tab lists the artifacts.
2. Open the artifact’s menu and click Scan. Scan Started confirms it.

Scan is in an artifact’s menu once its last scan has finished or was stopped. An artifact with no scan result has only Delete in its menu, so scan its repository or its project. While a scan is queued, running, or failed, the menu has Stop Scan instead; clicking it shows Scan Stopped.

Read the results

On the repository’s Info tab, the Vulnerabilities column shows each artifact’s result:

• <n> Total <n>-Fixable: the scan finished, with the number of vulnerabilities and how many of them have a fix. An artifact with no vulnerabilities reads 0 Total 0-Fixable.
• Scanning or Queued: the scan is running or waiting to run.
• Scan Stopped: the scan was stopped. Scan the artifact again to get a result.
• Not scanned: the artifact has no scan result. Scan its repository or its project.
• Scanner Not working: contact support with the project’s name and the repository.

The repository’s Vulnerability tab lists the vulnerabilities of the first artifact in the list, with their Vulnerability, Severity, CVSS3 score, Package, Current version, and Fixed in version. Each vulnerability’s name links to its details, and opening a row shows its description. To fix a vulnerability, rebuild the image with the package at its Fixed in version or later, and push it again. With no vulnerabilities, the tab says Currently No Vulnerability are there in this artifact.

(Optional) Keep vulnerable images from being pulled

Vulnerability prevention stops images with vulnerabilities at a chosen severity and above from being pulled; an image with no vulnerabilities at that level still pulls.

1. In MyAccount, under Storage, click Container Registry, click your project, and open its Configuration tab.
2. Under Deployment security, check Prevent vulnerable images from running. to turn prevention on, or clear it to turn prevention off. While it is checked, choose the Severity Level: Critical, High, Medium, Low, or None. The further down the list you choose, the more images are stopped: Critical stops only images with critical vulnerabilities, and None stops every image with any vulnerability.
3. Click Save.

The project’s configuration is updated. With prevention on, the project list reads Prevent images with vulnerability severity of and above from being deployed. Turning prevention off sets the level to None, and the list reads Deployment Security disabled. With prevention off, the level has no effect, and every image pulls.

Your images now carry their scan results. To run them on Kubernetes, see Pull images from a Kubernetes pod. If a pull fails with 412 after you turn prevention on, see Troubleshooting Container Registry. If Scan is not available, see Troubleshooting Container Registry.