Manage Image Security Vulnerabilities

By using the image security vulnerability scanning feature, you can manually or automatically scan OS package security vulnerabilities in images stored in Container Registry and the Secrets contained within the images. Based on the scan results, users can identify and remove known vulnerabilities (CVE) and Secrets, preventing the use of insecure images.

Vulnerability assessment support information

Supported OS

• The vulnerability scanning feature supports checking libraries installed via the package manager on the following operating systems.

Supported Language

• The vulnerability assessment feature supports checks for the following Language.

Support Secret

• The vulnerability scanning feature supports the following types of Secrets contained in the image.

Checking image security vulnerabilities (manual)

To check image security vulnerabilities, follow the steps below.

1. Click the All Services > Container > Container Registry menu. Navigate to the Service Home page of Container Registry.
2. On the Service Home page, click the Image menu. You will be taken to the Image List page.
3. Image List Click the Settings icon at the top of the page and select the Registry name and Repository name where the Image for detailed information is stored.
4. On the Image List page, click the resource (Image) to check for security vulnerabilities. You will be taken to the Image Details page.
   • Image Details Click the Tags tab to the right of the detailed information tab at the top of the page. You will be taken to the Tags tab page.
5. On the Tags tab page, click the More button located at the far right of the tag you want to check for security vulnerabilities, then click Vulnerability Check.
6. When the vulnerability check notification popup opens, click the Confirm button.
   • When the inspection starts, the phrase Vulnerability assessment will be performed. is displayed.
   • When the inspection is finished, the Vulnerability Inspection Results item displays a summary of the inspection results and a View Results button. Clicking the View Results button opens a popup that shows detailed analysis of Vulnerabilities by Image Digest (Tags).
     Reference

     • Click the View Results button to see the detailed vulnerability analysis results for the image tag.
       • After a vulnerability scan, if a red exclamation mark icon (!) appears in the scan date/time field, it means the vulnerability scan list for the Container Registry service has been updated. Click Vulnerability Scan to re‑scan, as new vulnerability items need to be checked for the image Digest (Tags).

View Image Security Vulnerability Scan Results

To view the vulnerability assessment results, follow these steps.

1. Click the All Services > Container > Container Registry menu. Navigate to the Service Home page of Container Registry.
2. On the Service Home page, click the Image menu. You will be taken to the Image List page.
3. Click the Settings icon at the top of the Image List page and select the Registry name and Repository name where the Image to be inspected is stored.
4. Image List page, click the resource (Image) to check for security vulnerabilities. You will be taken to the Image Details page.
   • Image Details Click the Tags tab on the right side of the detailed information tab at the top of the page. You will be taken to the Tags tab page.
5. On the Tags tab page, click the View Results button of the Vulnerability Check Result item for the tag whose vulnerability check results you want to view.
6. Image Tags Vulnerabilities Check the results in the popup window that displays the detailed analysis results.

View inspection results by vulnerability

Image Tag Vulnerabilities On the detailed page’s Vulnerabilities tab, you can view the image security vulnerability assessment results for each vulnerability.

In the Vulnerability tab, you can view the list of all discovered vulnerabilities.

View inspection results by package

Image Tag Vulnerabilities On the detail page, clicking the Package tab navigates to the package-specific vulnerability page. In the Package tab, you can view the image security vulnerability assessment results by package.

In the Package tab, you can view the full list of packages and the lists of packages with detected vulnerabilities and without detected vulnerabilities.

Check inspection results by secret unit

Image Tag Vulnerabilities On the detail page, clicking the Secret tab takes you to the vulnerability page for each secret. You can view the image security vulnerability assessment results by secret.

In the Secrets tab, you can view the complete list of secret files, as well as the lists of files with detected vulnerabilities and files without detected vulnerabilities.