| Scan type | What it catches |
|---|---|
| CVE | Known vulnerabilities in OS packages and language dependencies |
| Secrets | Tokens and keys baked into image layers |
| Misconfig | Dockerfile / image misconfigurations against best-practice policies |
Where images come from
Container scans run server-side from TigerGate’s infrastructure — you provide a registry credential and TigerGate pulls the image. No worker runs in your environment.| Registry | Credentials |
|---|---|
| Docker Hub | Username + password / access token |
| AWS ECR | Access key ID + secret access key + region |
| Google Container Registry (GCR) | GCP project ID + service account JSON |
| Azure Container Registry (ACR) | Service principal (client ID, client secret, tenant ID) |
| Harbor | URL + username + password |
| GitLab Container Registry | Personal access token (read_registry) |
| GitHub Container Registry (GHCR) | GitHub token with read:packages |
| Quay.io | OAuth token + organization |
| JFrog Artifactory | URL + Docker repository + access token |
Triggers
Container scans fire from:- Registry connect / sync — when a registry is connected or synced, TigerGate discovers its images and scans the latest tag of each. Controlled by the Auto-scan on registry connect setting.
- CI — your pipeline runs
tigergate scan --type image --image registry/repo:tagafter the build step. Used for gating. - Schedule — recurring scans (cron) re-scan images so newly-disclosed CVEs surface even when nothing has been pushed.
- Manual — dashboard → Container Security → Scan Image.
Findings
Scan findings appear under Container Security → Findings — severity, status, and rule detail, the same primitives as Code and Cloud Security. Vulnerabilities are mapped to OWASP Top 10 and CWE. Re-scanning an image replaces its previous findings; the image row is keyed on repository and tag. Each image also surfaces:- CVE count by severity
- OS distribution and architecture (reported by Trivy)
- Package count (SBOM size)
- License risk on SBOM components (permissive / weak-copyleft / copyleft / unknown)
SBOM
Every successful scan generates an SBOM via Trivy. View it under the image’s SBOM tab — component name, version, license, and license-risk classification — and download it as a JSON file with Download SBOM. The SBOM is also available over the API:Quality gate (CI)
Gating is enforced by the CLI in your pipeline.--fail-on sets which severities fail the build (default critical,high); --quality-gate enables the gate:
tigergate gate --scan-id <id> re-checks a completed scan run against the gate. Pass --quality-gate=false to upload results without ever failing the pipeline.