Container Security Documentation

Container Image Scanning

Connect any container registry with read-only credentials and scan images for CVEs, secrets, malware, and misconfigurations — on demand, on a schedule, or straight from your CI/CD pipeline.

Explore Container SecurityRequest Demo

What Every Scan Covers

A single scan inspects each image across four dimensions

Vulnerability Scanning

OS and application package CVEs with CVSS scoring, fixed-version, and KEV/exploit context.

Secrets Detection

Find hardcoded credentials, tokens, and private keys baked into image layers.

Misconfiguration Checks

Dockerfile and image best-practice issues — root user, exposed ports, missing HEALTHCHECK.

SBOM Generation

Full software bill of materials (SPDX / CycloneDX) with per-component license risk.

Connect a Container Registry

In the app, go to Integrations → Container Registry (or Container Security → Registries → Add Registry), pick your provider, and paste read-only credentials. TigerGate verifies the connection, discovers your images, and automatically scans each one.

Always use a dedicated, read-only credential. TigerGate only ever needs to list and pull images — never push, delete, or modify. Each section below shows exactly where to create the credential and the minimum scope to grant.

🐳

Docker Hub

Username + Access Token
Where to create it

Account Settings → Personal access tokens → Generate new token.

Minimum read-only permission

A Read-only access token (Public Repo Read-only for public images, Read for private repos). Used in place of your password.

Worked example
Provider: Docker Hub (private)
Username: acme-ci
Password: dckr_pat_xxxxxxxxxxxxxxxxxxxx # the access token
🔶

AWS ECR

Access Key + Secret + Region
Where to create it

IAM → Users → Create user (programmatic), then Security credentials → Create access key.

Minimum read-only permission

Attach AmazonEC2ContainerRegistryReadOnly. Minimum actions: ecr:GetAuthorizationToken, ecr:BatchGetImage, ecr:GetDownloadUrlForLayer, ecr:DescribeRepositories, ecr:ListImages.

Worked example
Provider: AWS ECR
AWS Access Key ID: AKIAIOSFODNN7EXAMPLE
AWS Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
AWS Region: us-east-1
🔴

Google GCR / Artifact Registry

Service Account JSON
Where to create it

IAM & Admin → Service Accounts → Create, then Keys → Add key → JSON.

Minimum read-only permission

roles/artifactregistry.reader (Artifact Registry) or roles/storage.objectViewer (legacy gcr.io). Both read-only. Paste the full JSON key.

Worked example
Provider: Google GCR / Artifact Registry
Service Account JSON: {
"type": "service_account",
"project_id": "acme-prod",
"client_email": "[email protected]",
"private_key": "-----BEGIN PRIVATE KEY-----\n..."
}
🔷

Azure ACR

Client ID + Secret + Tenant
Where to create it

Microsoft Entra ID → App registrations → New registration, then Certificates & secrets → New client secret.

Minimum read-only permission

Assign the service principal the built-in AcrPull role on the registry (Access control (IAM) → Add role assignment). AcrPull grants pull + catalog listing only.

Worked example
Provider: Azure ACR
Registry URL: myregistry.azurecr.io
Client ID: 11111111-1111-1111-1111-111111111111
Client Secret: 8Q~xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Tenant ID: 22222222-2222-2222-2222-222222222222
🐙

GitHub Container Registry (GHCR)

Personal Access Token
Where to create it

Settings → Developer settings → Personal access tokens → Tokens (classic) → Generate new token.

Minimum read-only permission

The read:packages scope — the only scope needed to list and pull from ghcr.io.

Worked example
Provider: GitHub Container Registry
Token: ghp_xxxxxxxxxxxxxxxxxxxx # classic PAT with read:packages
# Registry URL: ghcr.io → ghcr.io/acme/app:1.4
🦊

GitLab Container Registry

Username + Token
Where to create it

Preferences → Access Tokens (personal), or Settings → Repository → Deploy tokens (project/group).

Minimum read-only permission

A token with the read_registry scope. Use the token as the password and the token name (or your username) as the username.

Worked example
Provider: GitLab Container Registry
Registry URL: registry.gitlab.com
Username: tigergate-deploy
Password: glpat-xxxxxxxxxxxxxxxx # token with read_registry
🐸

JFrog Artifactory

Access Token or API Key
Where to create it

Administration → User Management → Access Tokens (identity token), or Edit Profile → Generate API Key.

Minimum read-only permission

A token/key for a user with only Read permission on the Docker repository. Set Docker Repo to the repo key (e.g. docker-local). Access Token preferred over API Key.

Worked example
Provider: JFrog Artifactory
Registry URL: mycompany.jfrog.io
Access Token: eyJ2ZXIiOiIyIi... # or API Key (AKCp...)
Docker Repo: docker-local
Username: reader # optional, only for basic auth
⚓

Harbor

Username + Password
Where to create it

User Profile (CLI secret), or Administration → Robot Accounts (recommended).

Minimum read-only permission

A robot account / user with project role Guest or pull permission only. Use the robot name as username and its secret as password.

Worked example
Provider: Harbor
Registry URL: harbor.example.com
Username: robot$acme+tigergate
Password: <robot-account-secret> # pull-only
🔵

Quay.io

OAuth / Robot Token
Where to create it

Repository or organization → Robot Accounts → Create Robot Account.

Minimum read-only permission

A robot account with Read permission on the target repositories. Use the robot token as the Token value.

Worked example
Provider: Quay.io
Token: <robot-account-token> # read permission on target repos
# Registry URL: quay.io → quay.io/acme/app:1.4
Scheduled Scans

Re-scan on a Schedule

New CVEs are published daily. A schedule re-runs scans automatically so vulnerabilities surface against images you already have.

Create a schedule

Go to Container Security → Schedules tab → New schedule. Pick a scope and a cron expression:

  • registry — re-scan every image in a connected registry (select the registry).
  • image — one repository, all tags (target = acme/app).
  • image_tag — one specific tag (target = acme/app:1.4).
  • pattern — a glob over repositories (target = acme/*).

Cron is the standard 5 fields, evaluated in UTC: minute hour day-of-month month day-of-week.

0 2 * * * # daily at 02:00 UTC
0 */6 * * * # every 6 hours
0 3 * * 1 # every Monday at 03:00 UTC
30 1 1 * * # 01:30 UTC on the 1st of each month

The next run is computed automatically from the cron expression. Toggle a schedule off to pause it without deleting.

CI/CD Image Scanning

Scan Images in Your Pipeline

Scan the image you just built before it ships. Uploaded results appear under Container Security → CI/CD Scans, each carrying its git commit.

TigerGate CLI

Image scanning is part of the same scan command — it runs whenever --image is set. With --upload the results flow into the platform.

# After building & pushing the image in CI:
docker run --rm \
-v "$PWD:/workspace" \
-e TIGERGATE_API_KEY="$TIGERGATE_API_KEY" \
tigergate/tigergate-cli:latest \
scan --type image --image registry.example.com/app:$GIT_SHA --upload
# Source + image in one pass (SAST + SCA + secrets + IaC + image):
... scan --type all --image registry.example.com/app:$GIT_SHA --upload
# To scan a locally built image, also mount the Docker socket:
# -v /var/run/docker.sock:/var/run/docker.sock

Link findings to running cloud assets (code → cloud)

Pass build/deploy metadata so a container finding links to the running asset by image digest + commit SHA. The rule of thumb: scan the digest you deploy.

... scan --type all --upload \
--image registry.example.com/app:$GIT_SHA \
--image-digest "$IMAGE_DIGEST" \
--deploy-target prod-eks/payments \
--environment production

TG_IMAGE_DIGEST / TG_DEPLOY_TARGET / TG_ENVIRONMENT work as environment variables too.

Ready to Secure Your Images?

Connect a registry in minutes and scan every image for CVEs, secrets, malware, and misconfigurations.

Request DemoExplore Container Security