Managing Image Security Vulnerabilities

By using the image security vulnerability inspection feature, you can manually or automatically check the OS package security vulnerabilities of images stored in the Container Registry and the Secrets included in the image. Users can identify and remove known vulnerabilities (CVE) and Secrets based on the inspection results to prevent the use of unsafe images.

Vulnerability Inspection Support Information

Supported OS

• Vulnerability inspection function supports checking libraries installed via package manager on the following OS.

Support Language

• The vulnerability inspection feature supports checks for the following Language.

Support Secret

• Vulnerability assessment feature supports the following types of Secrets included in the image.

Check Image Security Vulnerabilities (Manual)

To check image security vulnerabilities, follow the steps below.

1. All Services > Container > Container Registry Click the menu. Navigate to the Service Home page of Container Registry.
2. Click the Image menu on the Service Home page. Navigate to the Image list page.
3. Image list Click the Settings icon at the top of the page and select the Registry name and Repository name where the Image stored for checking detailed information is located.
4. Image List page, click the resource (Image) to check security vulnerabilities. Image Details page will be opened.

• Image Detail Click the Tags tab to the right of the detailed information tab at the top of the page. You will be taken to the Tags tab page.

5. Tags On the Tags tab page, click the More button located at the far right of the tag you want to check for security vulnerabilities, then click Vulnerability Check.
6. When the vulnerability check notification popup opens, click the Confirm button.
   • When the inspection starts, Vulnerability inspection will be conducted. is displayed.
   • When the inspection is finished, the Vulnerability Inspection Results item will display a summary of the inspection results and a View Results button. Clicking the View Results button will open a popup where you can see the detailed analysis results of Vulnerabilities by Image Digest (Tags).
     Reference

     • View Results button, when clicked, shows the detailed analysis results of vulnerabilities for the image tag.
       • If a red exclamation mark icon (!) appears in the inspection date/time field after a vulnerability check, it means the vulnerability check list for the Container Registry service has been updated. Click Vulnerability Check as a new vulnerability item check is required for the image Digest (Tags), so we recommend rechecking.

Check image security vulnerability assessment results

To check the vulnerability assessment results, follow the steps below.

1. All Services > Container > Container Registry Click the menu. Navigate to the Service Home page of Container Registry.
2. Click the Image menu on the Service Home page. Navigate to the Image list page.
3. Image List Click the Settings icon at the top of the page and select the Registry name and Repository name where the Image to view detailed information is stored.
4. On the Image List page, click the resource (Image) to check for security vulnerabilities. You will be taken to the Image Details page.

• Image Detail Click the Tags tab on the right side of the detailed information tab at the top of the page. It will navigate to the Tags tab page.

5. Tags on the tab page, click the View Results button of the Vulnerability Assessment Results item of the tag to check the vulnerability assessment results.
6. Vulnerabilities by Image Tags Check the results in the popup window where you can view the detailed analysis results.

Check inspection results by vulnerability unit

Image Tag-specific Vulnerabilities detail page’s Vulnerabilities tab allows you to view image security vulnerability assessment results by vulnerability.

Vulnerability tab allows you to view the list of all discovered vulnerabilities.

Check inspection results by package unit

Image Tag Vulnerabilities detailed page, when you click the Package tab, you are taken to the package-specific vulnerability page. In the Package tab, you can view the image security vulnerability check results by package.

Package tab allows you to view the full package list, as well as the list of packages with discovered vulnerabilities and the list of packages without discovered vulnerabilities.

Check results by secret unit

Image Tag Vulnerabilities on the detail page, click the Secret tab to go to the secret-specific vulnerability page. You can view the image security vulnerability scan results by secret.

In the Secret tab, you can view the full list of secret files, as well as the lists of files with discovered vulnerabilities and files without discovered vulnerabilities.