Freedom251 › Container Image Scanning Tools

O3 Security Image Scanner

Free plan Web

Visit O3 Security Image Scanner Alternatives Pricing

What O3 Security Image Scanner is

O3 Security Image Scanner examines container images before they move into a registry. It supports Docker, OCI, and distroless images, breaking each image into layers to inspect operating system packages, application code, credentials, and changes between layers. Its checks look for vulnerabilities, malicious binaries and signatures, unexpected cron jobs or startup scripts, obfuscated shell scripts, embedded secrets, and misconfigured permissions. Secret detection can find API keys, database credentials, and private keys left in an earlier layer even after a later layer deletes them.

Images can be scanned when pushed, when pulled through a scanning proxy, or on a recurring schedule. O3 connects to Amazon ECR, Google GCR and Artifact Registry, Azure ACR, Docker Hub, and private registries that use Docker Registry API v2. Scan results include SBOMs in CycloneDX and SPDX formats. Vulnerability findings match packages against NVD, OSV, and distribution-specific advisories, and include CVSS, exploitability, a fix version, and the layer that introduced the issue. Registry integration can prevent promotion to production when critical findings are present. O3 lists more than 30 native integrations across CI/CD, code editors, package managers, cloud, ticketing, and registries. It also offers self-hosted deployment within a customer VPC or air-gapped environment.

Who it suits

O3 suits teams that need to inspect container images and their layers for vulnerabilities, malware, secrets, and permission problems before registry promotion. It may also suit organizations seeking self-hosting in a customer VPC or air-gapped environment.

What it does well

Scans Docker, OCI, and distroless images.
Can scan on push, pull, or a recurring schedule.
Finds secrets that remain in earlier image layers.
Generates SBOMs in CycloneDX and SPDX formats.
Can block production promotion when critical findings appear.

What to know first

Pricing is available on request.
The listed platform is web.

Plans

Plan	Billed and limits	Price
Paid	Pricing on request	On request

As o3.security lists them, read 1 Oct 2026. The maker's own page has the final word.

Getting started

Visit https://o3.security/image-scanning.
Use the web platform to access the scanner.
Choose the paid plan; pricing is available on request.
Connect a supported registry or private registry using Docker Registry API v2.
Configure scans on push, on pull through a scanning proxy, or on a recurring schedule.

Verdict

Choose O3 Security Image Scanner if your team needs layered container image checks, SBOM output, or a registry gate for critical findings. Its price is available on request, so teams that need a published price should look elsewhere.

Questions

What does O3 Security Image Scanner inspect?

It checks container image layers for vulnerabilities, malicious content, secrets, and misconfigured permissions. Supported image formats are Docker, OCI, and distroless.

Which registries does it support?

Integrations include Amazon ECR, Google GCR and Artifact Registry, Azure ACR, Docker Hub, and private registries using Docker Registry API v2.

What does a scan produce?

Each scan generates SBOM output in CycloneDX and SPDX formats. Vulnerability results include CVSS, exploitability, fix version, and the introducing layer.

Can it block an image from production?

The registry integration can block promotion to a production registry when critical findings are present.

How much does it cost?

The pricing model is paid, with pricing available on request. A free plan is listed.

Can it be self-hosted?

O3 says it offers deployment inside a customer VPC or an air-gapped environment, with no outbound telemetry required.

Facts from O3 Security Image Scanner's own pages

Data protection: O3 states that data in transit uses TLS 1.3, data at rest uses AES-256, and production access is restricted, logged, and reviewed. · o3.security, 1 Oct 2026
Deployment: O3 states that it offers self-hosted deployment inside a customer VPC or air-gapped environment with no outbound telemetry required. · o3.security, 1 Oct 2026
Image formats: The scanner works with Docker, OCI, and distroless images. · o3.security, 1 Oct 2026
Integrations: O3 lists more than 30 native integrations across CI/CD, code editors, package managers, cloud, ticketing, and registries. · o3.security, 1 Oct 2026
Layer inspection: O3 decomposes and inspects every image layer, including OS packages, application code, credentials, and layer changes. · o3.security, 1 Oct 2026
Malware detection: O3 compares added binaries against known-good hashes and detects malicious signatures, unexpected cron jobs, startup scripts, and obfuscated shell scripts. · o3.security, 1 Oct 2026
Promotion blocking: The registry integration can block promotion to a production registry when critical findings are present. · o3.security, 1 Oct 2026
Purpose: O3 scans container images for OS vulnerabilities, malicious layers, embedded secrets, and misconfigured permissions before registry push. · o3.security, 1 Oct 2026
Registry integrations: The image scanner integrates with Amazon ECR, Google GCR and Artifact Registry, Azure ACR, Docker Hub, and private registries using Docker Registry API v2. · o3.security, 1 Oct 2026
Registry scanning: Images can be scanned on push, on pull through a scanning proxy, or on a recurring schedule. · o3.security, 1 Oct 2026
SBOM output: Each scan generates SBOM output in CycloneDX and SPDX formats. · o3.security, 1 Oct 2026
Secret detection: O3 detects secrets that remain in earlier layers even after later deletion, including API keys, database credentials, and private keys. · o3.security, 1 Oct 2026
Security certifications: O3 states that it is SOC 2 Type II and ISO 27001 certified, with audit reports available on request under NDA. · o3.security, 1 Oct 2026
Vulnerability intelligence: O3 matches packages against NVD, OSV, and distribution-specific advisories and reports CVSS, exploitability, fix version, and introducing layer. · o3.security, 1 Oct 2026

Where O3 Security Image Scanner stands on Freedom251

Container Image Scanning Tools#9 of 29