TigerGate Docs — code-to-cloud security platform

Add a tigergate scan --type image --image <ref> step to your pipeline so no tag reaches the registry unscanned. Image scanning is the same scan command used for code, with --type image. The CLI ships only as the tigergate/tigergate-cli image (entrypoint tigergate).

Prerequisites

A connected registry — TigerGate needs read access to pull the image.
A ci-cd-quality-gate API key in your CI’s secret store (the same key used for code scans — see API keys).

CI snippets

GitHub Actions
GitLab CI
Bitbucket Pipelines
Jenkins

name: Build + scan
on: [push, pull_request]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build image
        run: docker build -t myorg/app:${{ github.sha }} .

      - name: Push to registry
        run: |
          echo "${{ secrets.REGISTRY_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
          docker push ghcr.io/myorg/app:${{ github.sha }}

      - name: TigerGate image scan + gate
        run: |
          docker run --rm \
            -e TIGERGATE_API_KEY \
            tigergate/tigergate-cli:1.0.0 \
            scan --type image --image ghcr.io/myorg/app:${{ github.sha }} --upload
        env:
          TIGERGATE_API_KEY: ${{ secrets.TIGERGATE_API_KEY }}

--type image pulls the image from the registry directly, so no -v repo mount is needed (unlike code scans). The gate runs by default; add --quality-gate=false for report-only. A non-zero exit fails the step.

build:
  stage: build
  image: docker:24
  services: [docker:24-dind]
  script:
    - docker build -t $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA .
    - docker push $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA

scan:
  stage: test
  needs: [build]
  image: tigergate/tigergate-cli:1.0.0
  script:
    - tigergate scan --type image --image $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA --upload

pipelines:
  default:
    - step:
        name: Build + push
        services: [docker]
        script:
          - docker build -t $REGISTRY/$REPO:$BITBUCKET_COMMIT .
          - docker push $REGISTRY/$REPO:$BITBUCKET_COMMIT

    - step:
        name: TigerGate image scan
        image: tigergate/tigergate-cli:1.0.0
        script:
          - tigergate scan --type image --image $REGISTRY/$REPO:$BITBUCKET_COMMIT --upload

stage('Build') {
  steps {
    sh "docker build -t myorg/app:${BUILD_TAG} ."
    sh "docker push myorg/app:${BUILD_TAG}"
  }
}
stage('TigerGate scan') {
  steps {
    withCredentials([string(credentialsId: 'tigergate-api-key', variable: 'TIGERGATE_API_KEY')]) {
      sh "docker run --rm -e TIGERGATE_API_KEY tigergate/tigergate-cli:1.0.0 scan --type image --image myorg/app:${BUILD_TAG} --upload"
    }
  }
}

Quality gate

The image scan runs through the same CI quality gate as code scans. By default the build fails on critical or high findings (--fail-on critical,high); add --quality-gate=false to upload results without failing the build. Override the failing severities per run:

# default is critical,high
tigergate scan --type image --image myorg/app:1.4 --upload --fail-on critical,high

Tune the org-wide thresholds under CI/CD → Quality Gates in the dashboard — see Quality gates.

Scanning local images (without push)

You don’t have to push to a registry first — --image scans a locally built image by reference. Share the Docker socket so the CLI container can see it:

docker build -t app:dev .
docker run --rm \
  -e TIGERGATE_API_KEY \
  -v /var/run/docker.sock:/var/run/docker.sock \
  tigergate/tigergate-cli:1.0.0 \
  scan --type image --image app:dev --upload

The CLI uploads the findings (not the image), so this works fine even on slow CI uplinks.

SBOM

Image SBOMs are produced by TigerGate’s container scans of a connected registry, not by the CI CLI image scan. Each scanned image gets a CycloneDX bill of materials, viewable and downloadable (CycloneDX JSON) under Container Security → the image → SBOM tab.

​Prerequisites

​CI snippets

​Quality gate

​Scanning local images (without push)

​SBOM

Prerequisites

CI snippets

Quality gate

Scanning local images (without push)

SBOM