Sonatype Container Scanner

What Sonatype Container Scanner is

Sonatype Container Scanner checks container images for known vulnerabilities and helps enforce security policies before images are pushed or deployed. It analyzes operating system packages and application dependencies using Sonatype vulnerability intelligence, and supports OCI-compliant images. Remote images can be scanned without a running Docker daemon, avoiding Docker-in-Docker. Starting with IQ Server 1.196.0, the scanner is the default in IQ CLI and supported CI integrations, including Jenkins, GitHub Actions, GitLab, Azure DevOps, and Bamboo.

The scanner requires IQ Server 1.196.0 or later and IQ CLI 2.6.0 or later; the macOS IQ CLI bundle is not supported. Advanced Container Scanning covers APK, RPM/DNF, and APT package databases, but Windows-based container images are not supported. The wider container security ecosystem names Docker, Kubernetes, OpenShift, Rancher, Amazon ECS/EKS, GKE, AKS, IBM Cloud, and OKE. Sonatype describes its container security offerings as covering image scanning, risk identification, and policy enforcement across the software development lifecycle. The scanner uses a hybrid deployment model and provides registry and CI pipeline scanning. It is paid, pricing is on request, and the named plan is added to Sonatype Lifecycle with a customized quote available through sales.

Who it suits

Sonatype Container Scanner suits development and security teams that need vulnerability checks and policy enforcement for container images in registries or CI pipelines. It is relevant to teams using the supported CI integrations and container platforms, provided they meet the IQ Server and IQ CLI requirements.

Limits

The scanner requires IQ Server 1.196.0 or later and IQ CLI 2.6.0 or later. The macOS IQ CLI bundle and Windows-based container images are unsupported; Advanced Container Scanning covers APK, RPM/DNF, and APT package databases.

Getting started

1. Visit the Sonatype container security website.
2. Contact sales for a customized quote for the plan added to Sonatype Lifecycle.
3. Ensure IQ Server 1.196.0 or later and IQ CLI 2.6.0 or later are in place.
4. Use the scanner through IQ CLI or a supported CI integration.
5. Connect it to a supported registry or CI pipeline for image scanning.

Verdict

Consider Sonatype Container Scanner if your team needs container image vulnerability analysis and policy checks across registries or CI pipelines. Look elsewhere if you need to scan Windows-based container images or use the macOS IQ CLI bundle; pricing also requires a sales quote.