From a registry#
ztvs scan --image registry.example.com/api:1.4.2
ZTVS pulls the manifest and each layer, then resolves packages from the layers themselves rather than from any manifest label.
From a local tarball#
If the image is already on disk, or the registry needs credentials you would rather not hand to a scanner:
docker save api:1.4.2 -o api.tar
ztvs scan --archive api.tar
Authenticating#
ZTVS reads the standard Docker config:
export DOCKER_CONFIG=~/.docker
ztvs scan --image registry.example.com/api:1.4.2
Give the scanner a pull-only credential. It never needs push access, and a scanner with write access to your registry is a bigger problem than the vulnerabilities it finds.
Scanning only some layers#
To skip base-image layers you do not control:
ztvs scan --image api:1.4.2 --skip-layers 3
Findings from skipped layers are omitted, not suppressed — they will not appear
in the report at all. If you need them suppressed but visible, that arrived in
0.0.2 with policy files.