Scan a container image

Point ZTVS at an image in a registry or a local tarball.

أنت تتصفح الإصدار 0.0.1. الأحدث هو 0.0.2.

عرض 0.0.2

From a registry#

ztvs scan --image registry.example.com/api:1.4.2

ZTVS pulls the manifest and each layer, then resolves packages from the layers themselves rather than from any manifest label.

From a local tarball#

If the image is already on disk, or the registry needs credentials you would rather not hand to a scanner:

docker save api:1.4.2 -o api.tar
ztvs scan --archive api.tar

Authenticating#

ZTVS reads the standard Docker config:

export DOCKER_CONFIG=~/.docker
ztvs scan --image registry.example.com/api:1.4.2

Give the scanner a pull-only credential. It never needs push access, and a scanner with write access to your registry is a bigger problem than the vulnerabilities it finds.

Scanning only some layers#

To skip base-image layers you do not control:

ztvs scan --image api:1.4.2 --skip-layers 3

Findings from skipped layers are omitted, not suppressed — they will not appear in the report at all. If you need them suppressed but visible, that arrived in 0.0.2 with policy files.