What is Image Scan
Image Scan shows the vulnerabilities in the images you run, with the actively exploited ones at the top. It is free for up to 5 images and has no time limit: images are scanned again every day. To watch more images, talk to our sales team.
Address: hub.leavory.com/image-scan (sign in through the Hub).
What you get
Section titled “What you get”| Item | Detail |
|---|---|
| Images | Up to 5 per account on the free plan; more through our sales team |
| Scan | As soon as the image is added and then every day at 00:00 UTC |
| Order | Exploited vulnerabilities first, then by severity |
| Age | Publication date of each CVE (see CVE age) |
| Private images | Accepted from the managed registries listed below |
First use
Section titled “First use”-
Registries (optional). If any image is private, add the registry login first. You can add or change it later.
-
Images. Enter the images as
registry/repository:tag, for exampledocker.io/library/nginx:1.27. Docker Hub images can be written withoutdocker.io. -
Each image is scanned right away. Images with errors (wrong name, missing tag, no access) must be removed to continue.
Private images
Section titled “Private images”Add up to 3 registries per account. These managed registries are accepted:
| Registry | Address |
|---|---|
| Docker Hub | docker.io |
| GitHub Container Registry | ghcr.io |
| Quay | quay.io |
| GitLab | registry.gitlab.com |
| Azure Container Registry | <name>.azurecr.io |
| Google Artifact Registry / GCR | <region>-docker.pkg.dev, gcr.io |
- The login is tested before it’s saved and stored encrypted. The screen never shows the password again.
- Leavory can’t see the credential’s scope: limiting it to read access is up to you. Follow Registry credentials.
- Self-hosted registries (Harbor, Nexus, Artifactory, etc.) are not accepted by default. Contact support.
Read the result
Section titled “Read the result”The list shows each image with the date of its last scan. When you open an image you see the vulnerabilities with severity, package, fixed version, publication date and whether it is actively exploited.
Rescan all images scans all of them again right away, without waiting for the daily scan.