The container image scan feature can manage container images and detect security risks in a comprehensive manner. The risks include high-risk system vulnerabilities, application vulnerabilities, malicious samples, configuration risks, and sensitive data in images. The feature also supports quick fixing of detected image system vulnerabilities. You can use the feature to manage and ensure image security to protect related systems and data.
Limits
Container image scan is a value-added feature of Security Center and must be separately purchased. Only users of the Advanced, Enterprise, Ultimate, and Value-added Plan editions can purchase container image scan.
Supported regions
Only the Container Registry instances in the following regions support the container image scan feature.
Area | Supported region |
China |
|
Outside China |
|
Items that can be detected
Item | Description | Suggestion |
Image system vulnerability | The container image scan feature can detect vulnerabilities that may affect the security of the container environment, such as operating system vulnerabilities and third-party software vulnerabilities in images. | We recommend that you fix image system vulnerabilities at the earliest opportunity based on the fixing commands and impact descriptions that are provided by Security Center. |
Image application vulnerability | The container image scan feature can detect application vulnerabilities in images. The vulnerabilities can cause security issues such as unauthorized access, code injection, and denial-of-service (DoS) attacks. | We recommend that you fix image application vulnerabilities at the earliest opportunity based on the fixing commands and impact descriptions provided by Security Center. |
Image baseline risk | The container image scan feature can check whether images conform to security configuration specifications and best practices. | We recommend that you handle image baseline risks at the earliest opportunity based on the baseline check details that are provided by Security Center. |
Malicious image sample | The container image scan feature can detect malicious files, malicious code, and malicious behavior in images and during container runtime. | We recommend that you handle malicious file samples at the earliest opportunity based on the information provided by Security Center. The information includes paths to malicious files. |
Sensitive image file | The container image scan feature can detect common sensitive files, which include but are not limited to the following items:
| We recommend that you estimate risks based on the suggestions provided by Security Center, remove sensitive information at the earliest opportunity, and then recreate images. |
Image build command risks | The container image scan feature can detect image build command risks, which include but are not limited to the following items:
| We recommend that you handle the image build command risks based on the risk description provided by Security Center and then recreate images. |
The container image scan feature supports quick fixing of image system vulnerabilities. To handle other image risks, manually fix the risks based on the suggestions included in the risk details. For more information, see Handle detected image risks.
Supported operating systems and versions
Operating system | Operating system version that supports risk detection | Operating system version that supports risk fixing |
Red Hat |
| None |
CentOS |
|
|
Ubuntu |
|
|
Debian |
|
|
Alpine |
| Alpine 3.9 |
Amazon Linux |
| None |
Oracle Linux |
| None |
SUSE Linux Enterprise Server |
| None |
Fedora Linux |
| None |
openSUSE |
| None |
Use process
Enable container image scan: If you purchase the container image scan feature, you are charged based on the quota specified by Container Image Scan. You must enable the feature and set Container Image Scan to an appropriate value.
Scan images: Configure the image scan scope based on your business requirements. You can manually initiate an immediate image scan or configure a periodic image scan.
View and handle detected image risks: View the image scan results and handle the risks based on the fixing instructions.
References
For more information about the vulnerability management of servers, see Vulnerability management.
For more information about how to view the scan results of Elastic Compute Service (ECS) images, see View image scan results.