scan-vulnerabilities

To scan container images for security vulnerabilities before deployment, use Quay.io to analyze specified image tags for known threats. This process proactively identifies vulnerabilities, preventing potential breaches and ensuring compliance before release.

Yes, you can block deployment based on vulnerability severity using configurable failure policies. This feature allows you to define whether critical or high severity vulnerabilities found during the Quay.io scan should halt the deployment pipeline.

Container vulnerability scanning integrates directly with release, ephemeral deploy, and MR approval workflows. Before merging a pull request, the associated container image is automatically scanned and blocks the merge if critical vulnerabilities are detected.

To run a security scan on source code alongside container images, enable the optional source code scanning feature. This performs security audits using tools like Bandit or npm audit in addition to the standard Quay.io container image vulnerability scan.

The best way to automate vulnerability scanning for container security is integrating Quay.io scans into your CI/CD pipeline. This automates checks for known vulnerabilities before merging pull requests or releasing new versions, blocking deployment and sending notifications if critical threats are found.