Scanning Artifacts

Read more about vulnerability scanning and how the health score is calculated here.

Artifact Types Submitted to the Scanner

Only artifact types with known-scannable content are submitted to Trivy. Signature and attestation artifacts — including cosign signatures, in-toto attestations, and DSSE envelopes — are automatically skipped and never sent to the scanner. This allowlist-based filtering replaces the previous skiplist approach and prevents scanner errors caused by non-tar-archive layers being submitted to Trivy.

Run a System-Wide Scan

As a system administrator, you can scan all artifacts in your instance at once.

  • Go to Administration;
  • Click Interrogation Services;
  • Select Vulnerability tab;
  • Click Scan now.
Scan all artifacts

This will set the whole process in motion. You can watch the progress. Artifact scan progress

Scan Selected Artifacts Manually

To do this, you need to go to a certain project to pick up artifacts.

  • Click Projects in the navigation pane;
  • Click on a project in the project overview;
  • Click on a repository;
  • Select artifacts;
  • Optionally, filter artifacts;
  • Click Scan.
Scan selected artifacts

Schedule a Scan

Inside the vulnerability tab, you can schedule a system-wide scan. It will scan all artifacts in all projects.
The scan can be set to run:

  • hourly;
  • daily;
  • weekly;
  • or on a custom schedule entered in the CRON format.
Schedule system scan

Per-Artifact Scan Timeout

During a scan-all operation, the registry enforces a 3-minute timeout per artifact. If scanning a single artifact exceeds this limit, that artifact is marked as failed and the operation moves on to the next one. This prevents a slow or unresponsive artifact from exhausting database connections and blocking the entire scan-all job.