Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Scanning a Cloud Registry

Written by
Updated at September 30, 2026
View in Markdown

Registries are scanned using our Vulnerability Management (VM). You can configure scanning:

  • In the Yandex Security Deck interface. To do this, click Open Security Deck and follow this guide.
  • In the Cloud Registry interface by following this guide.

Note

You can only configure scanning for local and remote Docker registries. Only Docker images stored in the Cloud Registry cache are scanned in remote registries.

Warning

Scanning is not free of charge. For more information, see the Yandex Security Deck pricing policy.

Automatic scanning

You can configure settings for automatically scanning artifacts in the registry. You can also set up automatic scanning when creating a registry.

  1. In the management console, select the folder where the registry is located.

  2. Navigate to Cloud Registry.

  3. In the left-hand panel, select  Registries.

  4. Select the registry.

  5. Navigate to the Vulnerability scanner tab.

  6. Click Configure scanner.

  7. Optionally, enable Scan language packages under Language package scanning.

  8. Optionally, expand Scanning artifacts when adding to the registry and select:

    • All artifacts to scan all artifacts when pushing to the registry.
    • Only selected to specify the artifacts to scan when pushing to the registry. Click Add artifacts, select artifacts, and click Add.

  9. Optionally, expand Periodic artifact scanning and select:

    • All artifacts to scan all artifacts in the registry at specified intervals.
    • Only selected to specify which artifacts to scan at specified intervals. Click Add artifacts, select artifacts, and click Add.

    Specify the artifact scan interval.

  10. Click Save.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for creating an automatic scan policy:

    yc cloud-registry registry scan-policy create --help

  2. Create a JSON file with scan rules, e.g., scan-rules.json:

    {
  "pushRule": {
    "paths": ["*"],
    "disabled": false
  },
  "scheduleRules": [
    {
      "amount": "7",
      "intervalUnit": "DAYS",
      "paths": ["*"],
      "disabled": false
    }
  ]
}

    Where:

    • pushRule: Scan artifacts when pushing to the registry:

      • paths: List of paths to the artifacts to scan. To scan all artifacts in the registry, specify *.
      • disabled: Disable scanning.

    • scheduleRules: Scan artifacts in the registry at regular intervals:

      • amount: Number of time units in the scan interval.
      • intervalUnit: Time unit. The available value is DAYS.
      • paths: List of paths to the artifacts to scan. To scan all artifacts in the registry, specify *.
      • disabled: Disable scanning.

  3. Create an automatic scan policy:

    yc cloud-registry registry scan-policy create <policy_name> \
  --registry-id <registry_ID> \
  --description <policy_description> \
  --scan-lang-packages \
  --rules <path_to_file_with_rules>

    Where:

    • <policy_name>: Automatic scan policy name.
    • --registry-id: ID of the registry for which you are creating the policy.
    • --description: Policy description. This is an optional parameter.
    • --scan-lang-packages: Enable language package scanning. This is an optional parameter.
    • --rules: Path to the JSON file with scan rules. This is an optional parameter.

To create an automatic registry scan policy, use the create REST API method for the ScanPolicy or the ScanPolicyService/Create gRPC API call.

Scanning manually

You can manually start a scan of the selected artifacts in the registry.

  1. In the management console, select the folder where the registry is located.
  2. Navigate to Cloud Registry.
  3. In the left-hand panel, select  Registries.
  4. Select the registry.
  5. Navigate to the Vulnerability scanner tab.
  6. Click New scan.
  7. Select the artifacts you want to scan and click Add.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.

If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. See the description of the CLI command for scanning an artifact:

    yc cloud-registry artifact scanner scan --help

  2. Get a list of artifacts in the registry:

    yc cloud-registry registry list-artifacts <registry_name_or_ID>

  3. Start an artifact scan:

    yc cloud-registry artifact scanner scan <artifact_ID>

To start an artifact scan, use the ScannerService/Scan gRPC API call.

Previous
Lifecycle policy
Next
Installing and configuring Docker