Container image content analysis-Container Registry(ACR)-阿里云帮助中心

Features

This feature is available in the following regions: China (Hangzhou), China (Shanghai), China (Beijing), China (Shenzhen), China (Hong Kong), Singapore, US (Virginia), and Germany (Frankfurt).

Image content analysis

Image content analysis helps you ensure your containerized applications meet standards, reduce risks, and achieve efficient management and software supply chain transparency. It allows you to inspect and parse the composition and characteristics of container images. You can use this feature to detect security vulnerabilities, perform compliance checks, and manage and track software versions. This helps optimize component dependencies and improve the security and performance of your containers.

Step 1: Create a content analysis rule

Follow these steps to create a content analysis rule.

Log on to the Container Registry console.
In the top navigation bar, select a region.
In the left-side navigation pane, click Instances.
On the Instances page, click the Enterprise Edition instance that you want to manage.

In the navigation pane on the left of the Instances page, choose Security and Trust > Content Analysis, and then click Create Rule. Configure the parameters in the following table and click Confirm to create the rule.

Parameter	Description
Rule name	Enter a custom name for the rule.
Analysis method	The default value is Automatic Analysis.
Analysis scope	Select a scope for the content analysis: Namespace: Select a namespace. By default, all repositories within the selected namespace are analyzed. Repository: Select a target repository.

Step 2: Trigger content analysis

After you create a content analysis rule, you can analyze your container images.

Automatic analysis: The system automatically analyzes new images that you push to an image repository within the specified analysis scope. For existing images, you must trigger the analysis manually.
Manual analysis: You can trigger analysis for all images within the specified scope or for a specific image.
- To analyze all images within the scope:
  1. In the navigation pane on the left of the Instances page, choose Security and Trust > Content Analysis.
  2. In the Analytics Rules tab, find the target rule and click Scan in the Actions column.
  3. In the Task List tab, click View Task in the Actions column to view the scan information.
- To analyze a specific image within the scope:
  1. On the Repositories page, click the target image repository. Then, in the navigation pane on the left, click Tags.
  2. On the Image Version page, click Content Analysis in the Actions column for the target tag. On the Content Analysis page, click Analyze Now.

After the analysis is complete, the system generates the content analysis results and a software bill of materials (SBOM) artifact. The SBOM artifact uses the_sbom suffix and complies with the CycloneDX standard format, which helps distinguish it from other artifacts. You can use ORAS and a tag to obtain the SBOM file of the target image.

After you expand the generated SBOM artifact in the Tags list, the Type column is marked as SBOM. The Actions column offers operations such as Security scan, Layer information, and Dependency analysis.

Step 3: View analysis results

The image content analysis results detail an image tag's operating system package components, including their dependencies, version, and risk status. The results also list all other image tags that contain the same package.

On the Repositories page, click the target image repository. Then, in the navigation pane on the left, click Tags.
On the Image Version page, click Content Analysis in the Actions column for the target tag.
On the Content Analysis page, view the analysis results. The results include three package types: Operating System, Operating System Package, and Language Package, along with their Tag and Risk Status.

Note
Due to operating system limitations, scan results may not be returned for some operating systems. You can submit a ticket for support.
In the Actions column for a target package, click View images containing this package. In the side panel that appears, you can view all image tags within the analysis scope that contain the package.
Note
The query results show image tags that contain the package and meet one of the following conditions:
- The image has been analyzed.
- The image has not been analyzed, but the digest of its image layer matches the digest of the layer where the package is located. This indicates that the image layer is reused by multiple images.
Additionally, content analysis also finds multi-architecture images and images with tags that were overwritten by repeated pushes after artifact cleanup. These images are listed in the repo@digest format.

SBOM files

A software bill of materials (SBOM) is an inventory of the components in a piece of software, similar to a bill of materials (BOM) in manufacturing. It describes the components, dependencies, and version information of the software, which is crucial for understanding its structure and ensuring security and compliance. An SBOM file helps you understand your software's composition, identify and manage dependencies, ensure security and compliance, simplify audits, improve emergency response, support software supply chain transparency, and optimize development and maintenance processes. The following code provides an example of an SBOM file.

{
  "bomFormat": "CycloneDX",     # The SBOM format type.
  "specVersion": "1.3",        
  "serialNumber": "urn:uuid:47c90508-80a5-4cec-91f3-9920d765e3b5",     
  "version": 1,
  "components": [               # A list of software components. Each component includes its type, name, version, license information, and package URL.
    {
      "type": "library",
      "name": "openssl",
      "version": "1.1.1",
      "licenses": [
        {
          "license": {
            "id": "Apache-2.0"
          }
        }
      ],
      "purl": "pkg:generic/openssl@1.1.1"
    },
    {
      "type": "library",
      "name": "curl",
      "version": "7.76.1",
      "licenses": [
        {
          "license": {
            "id": "MIT"
          }
        }
      ],
      "purl": "pkg:generic/curl@7.76.1"
    }
  ],
  "dependencies": [            # A list of dependencies between components.
    {
      "ref": "pkg:generic/openssl@1.1.1",
      "dependsOn": []
    },
    {
      "ref": "pkg:generic/curl@7.76.1",
      "dependsOn": [
        "pkg:generic/openssl@1.1.1"
      ]
    }
  ]
}

Obtain an SBOM file by using ORAS

Prerequisites

You have an ORAS client installed locally that can connect to Container Registry (ACR).
Your ACR Enterprise Edition instance is in a region that supports the image content analysis feature. For a list of supported regions, see Feature description.

Pull by tag

The image tag must have the _sbom suffix.

Run the following command to log in to the image repository:

oras login --username=<your-username> <your-instance-name>-registry.<your-instance-region>.cr.aliyuncs.com
Password:
Login Succeeded

Obtain the SBOM file.

oras pull <your-instance-name>-registry.<your-instance-region>.cr.aliyuncs.com/<your-namespace>/<your-repository-name>:<image-tag>_sbom

Pull by digest

Run the following command to log in to the image repository:

oras login --username=<your-username> <your-instance-name>-registry.<your-instance-region>.cr.aliyuncs.com
Password:
Login Succeeded

Obtain the image digest.

oras discover <your-instance-name>-registry.<your-instance-region>.cr.aliyuncs.com/<your-namespace>/<your-repository-name>:<image-tag>

Expected output:

<your-instance-name>-registry.<your-instance-region>.cr.aliyuncs.com/<your-namespace>/<your-repository-name>@sha256:1f5745d79a9f820f5bXXXXXXXXXX5f626eb49aff9
└── application/vnd.cyclonedx+json
    └── sha256:0f0206650a86a16XXXXXXXX3891b22a9d649501229f83

Obtain the SBOM file.

oras pull <your-instance-name>-registry.<your-instance-region>.cr.aliyuncs.com/<your-namespace>/<your-repository-name>@sha256:0f0206650a86a16XXXXXXXX3891b22a9d649501229f83