Container registry scanning basics
Overview
Images ship dependencies; defects propagate fast. Registry scanning (ACR Defender, ECR scanning, third-party CI scanners) catches known CVEs before prod pull.
Baseline setup
- Enable scanning on push; block critical severities on
latestprod tags via policy where DevOps agrees. - Separate dev and prod registries or repositories with RBAC; no shared admin password.
Workflow integration
CI: docker scan / Trivy / Grype fail build above threshold. CD: only signed images deploy; cosign or Notation depending on stack.
Operational reality
False positives happen—maintain allow lists with expiry for acceptable risks tied to a ticket. Patch base images monthly even if apps “did not change.”
Evidence
Export scan reports for ISO/SOC folders quarterly; tie to change records for base image bumps.
Related Articles
EDR deployment checklist for new workstations
## Overview Use this runbook when onboarding a new Windows workstation or re-imaging a device that...
Handling Defender for Business false positives
## Overview False positives waste analyst time and train users to ignore alerts. This article stand...
Application allowlisting with Windows Defender ASR rules
## Overview Attack Surface Reduction (ASR) rules reduce exploit surface by constraining Office macr...