Scanning Images for Vulnerabilities

If you enable repositories for image scanning, you must give the Vulnerability Scanning service permission to pull images from Container Registry.

allow service vulnerability-scanning-service to read repos in tenancy
allow service vulnerability-scanning-service to read compartments in tenancy

allow service vulnerability-scanning-service to read repos in compartment <compartment-name>
allow service vulnerability-scanning-service to read compartments in compartment <compartment-name>

When you create a new repository, image scanning is disabled by default. You can use the Console to enable image scanning for a repository by creating a new image scanner. If image scanning has already been enabled, you can use the Console to disable it.

To enable image scanning for a repository:

1. Open the navigation menu and click Developer Services. Under Containers & Artifacts, click Container Registry.
2. Select the region that contains the registry.

3. Select the compartment that contains the repository.

   The Repositories and images field lists the repositories in the selected region and compartment to which you have access.

4. From the list, select the repository.
5. Click Add scanner and either accept the default settings (usually sufficient) or specify:
   • Target name: Optionally, a name for the new image scanner.
   • Create in compartment: The compartment in which to create the image scanner. The compartment to which the repository belongs is selected by default, but you can select an alternative compartment.
   • Description: Optionally, a description of the scanner.
6. Select the scan configuration to use. A scan configuration identifies the images to scan, by designating the compartments to which images belong. You will typically select an existing scan configuration, or create a new scan configuration, that designates the compartment to which the repository itself belongs.
   • Create new scan configuration: Scan images belonging to the compartment to which the repository itself belongs, by creating a new scan configuration. Either accept the default settings (usually sufficient) or optionally enter a name for the new scan configuration, and select the compartment in which to create the new scan configuration. All the images in the repository will be scanned.
   • Select existing scan configuration: Scan images belonging to the compartment(s) specified in an existing scan configuration. By default, you can see and select scan configurations belonging to the same compartment as the repository. Click Change Compartment to see and select scan configurations belonging to other compartments. All the images in the repository will be scanned, provided the repository belongs to one of the designated compartments in the existing scan configuration you choose.

7. Click Create to create the new image scanner with the scan configuration you specified.

   From now on, any images pushed to the repository are scanned for vulnerabilities by the image scanner. If the repository already contains images, the four most recently pushed images are immediately scanned for vulnerabilities.

To disable image scanning for a repository:

1. Open the navigation menu and click Developer Services. Under Containers & Artifacts, click Container Registry.
2. Select the region that contains the registry.

3. Select the compartment that contains the repository.

   The Repositories and images field lists the repositories in the selected region and compartment to which you have access.

4. From the list, select the repository.
5. Click Remove scanner.

To view the results of image scans:

1. Open the navigation menu and click Developer Services. Under Containers & Artifacts, click Container Registry.
2. Select the region that contains the registry.
3. To see vulnerabilities detected in a particular image in a repository:

   1. Select the compartment that contains the repository.

      The Repositories and images field lists the repositories in the selected region and compartment to which you have access.

   2. Click the plus (+) button beside the name of the repository that contains the image for which you want to see scan results.

      Below the name of the repository, the images in the repository are listed, identified by the version identifier of each image.

   3. From the list, select the image.
4. Display the Scan results tab to see a summary of each scan of the image for the last 13 months, showing:
   • Risk level: The risk level posed by the image, derived by aggregating the risk levels of individual vulnerabilities found in the scan into a single overall risk level.
   • Issues found: The number of vulnerabilities found in the scan.
   • Scan started: and Scan finished: When the scan was run.
5. (optional) To see more information about the vulnerabilities found in a particular scan, select View details from the Action menu beside the scan on the Scan results tab to display the Scan details dialog showing:
   • Issue: The name given to the vulnerability in the CVE database. Click the link to find out more information about it.
   • Risk level: The severity level of the vulnerability. Critical is the highest level (for the most serious issues that should be your highest priority to resolve), followed by High, then Medium, then Low, and finally Minor (indicating the least serious issues that you still need to resolve, but which can be your lowest priority).
   • Description: A description of the vulnerability.
6. Click Close.

Use the Vulnerability Scanning CLI commands to scan images for vulnerabilities (see Container Image Targets).

For a complete list of flags and variable options for CLI commands, see the Command Line Reference.

For information about using the API and signing requests, see REST API documentation and Security Credentials. For information about SDKs, see SDKs and the CLI.

Use the Vulnerability Scanning API to scan images for vulnerabilities (see Container Image Targets).