Image tag security scan-Container Registry(ACR)-阿里云帮助中心

The container image security scanning feature identifies, assesses, and fixes known vulnerabilities in your images.

Background

In a cloud-native CI/CD pipeline, Container Registry (ACR) automatically performs a security scan after an image is pushed. If you have configured a security blocking policy, ACR identifies security risks in images and blocks high-risk container images. The CI/CD pipeline then distributes and deploys only the images that pass the security policy. This practice helps ensure the secure delivery and efficient deployment of container applications. You can also integrate the security scan API to implement image security scans on a custom schedule. If you do not use a CI/CD pipeline, you can create a scan rule on the Image Scanning page to automatically trigger a scan when an image is pushed. For more information, see Create a scan rule.

The duration of a security scan depends on the size of the image. In most cases, an image scan completes within three minutes.

Limitations

Trivy scan engine: Due to scan engine limitations, a single image layer should not exceed 3 GB. Otherwise, the scan may fail. For images larger than 3 GB, use the Security Center scan engine.

Scan a single image

Log on to the Container Registry console.
In the top navigation bar, select a region.
In the left-side navigation pane, click Instances.
On the Instances page, click the Enterprise Edition instance that you want to manage.
In the left-side navigation pane of the management page of the Enterprise Edition instance, choose Repository > Repositories.
On the Repositories page, find the repository that you want to manage and click Manage in the Actions column.
On the repository details page, click Image Version in the left-side navigation pane. Find the target tag and click Security Scan in the Actions column.
On the Security Scan page, click Scan.

After the scan is complete, the Security Scan page displays the results, including detailed vulnerability information. For more information about the scan results, see Image scan results.

Scan images in batches

The batch image scanning feature supports both the Trivy scan engine and the Security Center scan engine. The differences are as follows:

Trivy scan engine: An open source scan engine that detects system vulnerabilities and application vulnerabilities. It updates its vulnerability database daily. This engine does not support the Fix feature for system vulnerabilities.
- System vulnerabilities: Scans images for system vulnerabilities to help you ensure that your images are secure and trusted.
- Application vulnerabilities: Scans for vulnerabilities in container-related middleware. This helps you locate vulnerabilities so you can fix them and create a secure runtime environment for your images.
- The vulnerability database is updated daily, ensuring you receive the latest vulnerability information for timely security responses.
Security Center scan engine: An Alibaba Cloud-developed proprietary scan engine. It detects system vulnerabilities, application vulnerabilities, baseline risks, and malicious samples. It supports the Fix feature for system vulnerabilities.
- System vulnerabilities: Scans images for system vulnerabilities and provides the Fix feature to help you ensure that your images are secure and trusted.
- Application vulnerabilities: Scans for vulnerabilities in container-related middleware. This helps you locate and fix vulnerabilities to create a secure runtime environment for your images.
- Baseline risks: Checks for baseline security risks in your container assets. This helps you locate and fix the baseline security risks.
- Malicious samples: Detects malicious samples in containers and shows security threats in your assets. This helps you locate and remove malicious samples, significantly reducing the security risks of using containers.

Configure a VPC for your Enterprise Edition instance. For more information, see Configure access control for a VPC.

You must configure a VPC for the Enterprise Edition instance, which the batch image scanning feature uses to scan images.

If this is the first time you use the Security Center scan engine, you must access the Security Center console. The first time you access the console, you are prompted to create the AliyunServiceRoleForSas system role.

Note
If you have already configured a VPC for the Enterprise Edition instance, you can skip this step.
Log on to the Container Registry console.
In the top navigation bar, select a region.
On the Instances page, click the Enterprise Edition instance that you want to manage.
On the management page of the Enterprise Edition instance, choose Security and Trust > Image Scanning.
Select a scan engine.
- Set the scan engine to Trivy Scan Engine.
  - If you have not purchased the Security Center scan engine, the Trivy scan engine is used by default on the Image Scanning page.
  - If you have purchased the image scanning service in Security Center, the system switches the scan engine to the Security Center scan engine. To switch back, on the Image Scanning page, click Switch next to Security Center Scan Engine in the upper-right corner. Then, click Trivy Scan Engine and click Confirm in the Tips dialog box.
- Set the scan engine to Security Center Scan Engine
  
  If you have purchased the Security Center scan engine, it is the default engine on the Image Scanning page and no further action is required. If you have not purchased the Security Center scan engine, perform the following steps:
  1. Grant Security Center permission to call the OpenAPI operations of ACR.
    1. Click Cloud Resource Access Authorization.
    2. On the Cloud Resource Access Authorization page, click Confirm Authorization Policy.
  2. On the Image Scanning page, click Upgrade Security Center Scan Engine Now in the Scan Information area.
  3. Set Security Scan to Security Center Scan Engine, configure other parameters based on your requirements, click Buy Now, and then complete the payment.
    
    Return to the Image Scanning page. The Security Center scan engine is now used by default.
    
    Note
    After you purchase the Security Center scan engine, on the Image Scanning page, you can click Settings in the Scan Information area. In the Tips dialog box, select Replication, and then click Confirm. Once synchronization is enabled, Container Registry automatically syncs instance deletion, image push, image deletion, and repository deletion events to Security Center.
Create a scan rule.
1. On the Image Scanning page, click Create Rule.
2. In the Scan Rules wizard, enter a Rule Name, set the Scope, and then click Next.
  You can scan images by namespace or by repository:
  - By namespace: Select a Namespace and enter a regular expression to filter tags.
  - By repository: Select a Namespace and a Repository, and then enter a regular expression to filter tags.
3. Optional: In the Event Notification wizard, configure a notification method.
  You can send notifications via DingTalk, HTTP, or HTTPS:
  - DingTalk: Set Notification Method to DingTalk, and then enter the Webhook URL and secret token.
  - HTTP: Set Notification Method to HTTP, and then enter the HTTP address.
  - HTTPS: Set Notification Method to HTTPS, and then enter the HTTPS address.
  After an image scan succeeds, the system sends a notification to the configured DingTalk, HTTP, or HTTPS endpoint.
4. Click Create.
Manually trigger an image scan.

Note
After you create a scan rule, you can trigger image scans manually or automatically. An automatic scan triggers whenever an image is successfully pushed or built.
1. On the Image Scanning page, find the target rule and click Scan in the Actions column.
2. In the dialog box that appears, click Confirm.
  
  In the Task List, a scan is successful when its Status changes to Completed.
View the scan results.
1. On the Image Scanning page, find the target task in the Task List section and click View Task in the Actions column.
2. On the Task Details page, find the task and click View Details in the Actions column.
  
  You can view the scan results, including detailed vulnerability information, on the Security Scan page.
  
  Note
  If the scan rule that you configured includes multiple images, the Task Details page displays multiple tasks. You can view the scan results of any task.

Image scan results

Results from the Trivy scan engine

On the Security Scan page, you can view the detected system vulnerabilities and application vulnerabilities. The scan results are summarized by four severity levels: High, Medium, Low, and Unknown, and are sorted by severity level by default. On the Trivy scan engine tab, a donut chart and category statistics provide a vulnerability overview. For example, if a scan finds a total of 42 security vulnerabilities, the overview may show 12 High, 28 Medium, 2 Low, and 0 Unknown. The vulnerability list below includes columns such as CVE Number, Severity, Package, Current Version, Fixed Version, and Location. You can filter vulnerabilities by severity level. To trigger a new scan, click Rescan in the upper-right corner.

Note

Due to the limitations of the open source Trivy scan engine, it can identify the file location for only some system or application vulnerabilities.

Results from the Security Center scan engine

On the Security Scan page, you can view detected System Vulnerabilities, Application Vulnerabilities, Baseline Check, and Malicious Samples. The scan results are summarized by four severity levels: High, Medium, Low, and Unknown, and are sorted by severity level by default.

The vulnerability list is displayed in a table that includes columns such as Severity, Vulnerability Name, Package, Current Version, CVE Number, Location, Status, and Actions. You can use the Severity drop-down list and the CVE Number search box to filter vulnerabilities. In the Actions column, click Fix to fix an unfixed vulnerability, or click Rescan in the upper-right corner to refresh the scan results.

Fix system vulnerabilities

The Security Center scan engine also provides a Fix feature for system vulnerabilities. To use this feature:

On the Security Scan page, select the vulnerabilities that you want to fix, and click Fix at the bottom of the page. In the Fix dialog box, specify whether to overwrite the original image with the fixed image, and then click Fix Now.

After about 10 minutes, click the icon in the upper-left corner of the Security Scan page. On the Image Version page, a new image with the _fixd suffix appears. This indicates the image was fixed successfully.