Scan a container image

Point ZTVS at an image in a registry or a local tarball.

From a registry#

ztvs scan --image registry.example.com/api:1.4.2

From a local tarball#

docker save api:1.4.2 -o api.tar
ztvs scan --archive api.tar

Authenticating#

ZTVS reads the standard Docker config:

export DOCKER_CONFIG=~/.docker
ztvs scan --image registry.example.com/api:1.4.2

Give the scanner a pull-only credential.

Excluding base-image layers#

0.0.1 had --skip-layers, which dropped findings silently. It still works but is deprecated: prefer a policy, which records the decision.

# ztvs.policy.yaml
suppress:
  - where:
      layer_index: { below: 3 }
    reason: "Base image, patched on the platform team's cadence"
    review_by: 2026-12-01
ztvs scan --image api:1.4.2 --policy ztvs.policy.yaml

The findings still appear in the JSON report with "suppressed": true and the reason attached. Your auditor will ask; this is the answer.

Pinning by digest#

Tags move. To scan exactly what you shipped:

ztvs scan --image registry.example.com/api@sha256:9f2c…