Implement container image scanning in registry and pipeline
Implementation Effort: Medium – Wiring image scanning into the CI pipeline, the registry, and runtime spans build, platform, and security teams across several configuration points.
User Impact: Low – Enabling and tuning image scanning is an administrator action in the pipeline and registry; end users are not affected.
Lifecycle Stage: Build
Overview
Implement container image scanning in CI pipelines and registries so vulnerable images are identified before deployment and monitored after push.
Prerequisites:
- Enable Microsoft Defender for Containers in Microsoft Defender for Cloud for the relevant subscriptions.
- Verify registry access requirements for the environment.
- For multicloud registries or clusters, confirm the current support matrix and any Azure Arc or connector prerequisites.
Container images bundle application code with an entire operating system layer, package manager libraries, and runtime dependencies. Each component can carry known vulnerabilities. If images are not scanned before deployment, the organization places workloads into production with an unknown vulnerability surface.
Use image vulnerability scanning in the CI pipeline to catch issues before an image is pushed. Use registry scanning to assess images after push or import and during daily rescans. Use runtime container vulnerability assessment to identify vulnerable images running in Kubernetes. Runtime behavioral threat detection is a separate control covered by the runtime container threat protection task.
Registry vulnerability assessment is natively supported for Azure Container Registry (ACR). For AWS ECR, Google GCR, or other registries, confirm the current Defender for Containers support matrix for post-push registry scanning. Where registry-level integration is not available, use CI/CD pipeline scanning with Microsoft Security DevOps or Defender for Cloud CLI before push to ensure coverage.
Microsoft Defender for Containers provides registry-based vulnerability assessment for supported registries when the required Defender plan components are enabled. New or updated images are linked to vulnerability findings that surface as security recommendations. Running-container vulnerability findings depend on the documented extensions and prerequisites for the Kubernetes environment.
Dependabot can help teams review Docker base-image tag updates and application dependency alerts in the repository workflow. However, OS and package CVEs require container scanning tools. Microsoft Security DevOps, the Defender for Cloud CLI, or equivalent CI tooling can scan images during the build pipeline so issues are found before images are pushed. Treat repository-centric checks as complementary to Defender for Cloud registry and runtime coverage, not as replacements.
Without container image scanning in both pipeline and registry, organizations have no reliable way to enforce a minimum security baseline on what runs inside their clusters. Scanning images before deployment and continuously after push applies Verify explicitly to every image, and treating each image layer as a potential source of known vulnerabilities reflects Assume breach.