Discuss with expertTry it for free
© 2026 Direct Cursus Technology L.L.C.

Scanning Docker images for vulnerabilities

Written by
Updated at August 10, 2026
View in Markdown

You can scan Docker images pushed to a registry for vulnerabilities. You can do this:

Warning

  • The vulnerability database is continuously updated with vulnerability information from multiple sources.
  • For some vulnerabilities, there is no information on the package versions that will include the fix. This is because such information is not available in the current sources.
  • The number of Docker image scans you can run per cloud is limited.
  • Scanning Docker images for vulnerabilities is charged.

Manually

  1. In the management console, select the folder containing the registry with the Docker image.
  2. Navigate to Container Registry.
  3. Select the registry containing the Docker image or create a new one and push an image to it.
  4. Open the repository with the Docker image.
  5. Click next to the Docker image and select Scan.
  6. Wait for the scan to complete. During the scan, the Docker image scan status will be Scanning and, once completed, it will change to Ready.
  7. Check the scan results. To do this, click Date of last scan column value in the row with your Docker image.

To view scan runs for your Docker image, select the image and go to the Scan history tab.

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

  1. Get a list of Docker images in the registry:

    yc container image list --repository-name=<registry_ID>/<Docker_image_name>

    Result:

    +----------------------+---------------------+-----------------------------+---------+-----------------+
|          ID          |       CREATED       |            NAME             |  TAGS   | COMPRESSED SIZE |
+----------------------+---------------------+-----------------------------+---------+-----------------+
| crpqmsqp5mtb******** | 2021-02-09 08:57:14 | crpp7p7dovf4********/ubuntu | example | 27.2 MB         |
+----------------------+---------------------+-----------------------------+---------+-----------------+

  2. Start a Docker image scan:

    yc container image scan <Docker_image_ID>

    Result:

    done (24s)
id: che1el9t4t95********
image_id: crpqmsqp5mtb********
...
  medium: "6"
  low: "13"
  negligible: "3"

  3. Get detailed information on the scan results:

    yc container image list-vulnerabilities --scan-result-id=<scan_result_ID>

    Result:

    +------------+----------------+---------+-----------------+----------+---------------------------------------------------------------+
|  SEVERITY  |      NAME      | PACKAGE |     VERSION     | FIXED BY |                             LINK                              |
+------------+----------------+---------+-----------------+----------+---------------------------------------------------------------+
...
| NEGLIGIBLE | CVE-2016-10228 | glibc   | 2.31-0ubuntu9.1 |          | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10228 |
| NEGLIGIBLE | CVE-2017-11164 | pcre3   | 2:8.39-12build1 |          | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11164 |
| NEGLIGIBLE | CVE-2020-14155 | pcre3   | 2:8.39-12build1 |          | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14155 |
+------------+----------------+---------+-----------------+----------+---------------------------------------------------------------+

    To view scan runs for a Docker image, run this command:

    yc container image list-scan-results --repository-name=<registry_ID>/<Docker_image_name>

    Result:

    +----------------------+----------------------+---------------------+--------+--------------------------------+
|          ID          |        IMAGE         |     SCANNED AT      | STATUS |        VULNERABILITIES         |
+----------------------+----------------------+---------------------+--------+--------------------------------+
| che1el9t4t95******** | crpqmsqp5mtb******** | 2021-03-16 14:34:02 | READY  | medium:6, low:13, negligible:3 |
+----------------------+----------------------+---------------------+--------+--------------------------------+

To scan a Docker image, use the scan REST API method for the Scanner resource or the ScannerService/Scan gRPC API call.

To get the scanResultId scan result ID, use the getLast REST API method for the Scanner resource or the ScannerService/GetLast gRPC API call.

To get detailed information about scan results, use the listVulnerabilities REST API method for the Scanner resource or the ScannerService/ListVulnerabilities gRPC API call.

On push

  1. In the management console, select the folder containing the registry with Docker images.
  2. Navigate to Container Registry.
  3. Select the registry or create a new one.
  4. Navigate to the Vulnerability scanner tab.
  5. Click Edit settings.
  6. Under Scan Docker images when uploading, select Scan and one of the scanning options:
    • All repositories to scan all registry repositories.
    • Selected to scan only selected repositories:
      1. Click Select repositories.
      2. Select the repositories from the list.
      3. Click Save.
  7. Click Save.

To automatically scan Docker images on push to a registry, use the create REST API method for the ScanPolicy resource or the ScanPolicyService/Create gRPC API call.

To get the scanResultId scan result ID, use the getLast REST API method for the Scanner resource or the ScannerService/GetLast gRPC API call.

To get detailed information about scan results, use the listVulnerabilities REST API method for the Scanner resource or the ScannerService/ListVulnerabilitiesListVulnerabilities gRPC API call.

On schedule

  1. In the management console, select the folder containing the registry with Docker images.
  2. Navigate to Container Registry.
  3. Select the registry or create a new one.
  4. Navigate to the Vulnerability scanner tab.
  5. Click Edit settings.
  6. Under Scheduled Docker image scans, click Add scan rule.
  7. Select Scan and one of the scanning options:
    • All repositories to scan all registry repositories.
    • Selected to scan only selected repositories:
      1. Click Select repositories.
      2. Select the repositories from the list.
      3. Click Save.
  8. Specify how often you want to run Docker image scans.
  9. Click Save.

To run scheduled Docker image scans, use the create REST API method for the ScanPolicy resource or the ScanPolicyService/Create gRPC API call.

To get the scanResultId scan result ID, use the getLast REST API method for the Scanner resource or the ScannerService/GetLast gRPC API call.

To get detailed information about scan results, use the listVulnerabilities REST API method for the Scanner resource or the ScannerService/ListVulnerabilitiesListVulnerabilities gRPC API call.

Previous
Deleting a lifecycle policy
Next
Creating a trigger for a registry