Managing Repository Images

Constraints and Limitations

• Only the HSS container edition supports this function. For details about how to purchase and upgrade HSS, see Purchasing an HSS Quota and Upgrading Your Edition.

• Security scans can be performed only on Linux images.

Viewing Repository Image Information

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Asset Management > Containers & Quota.

   If your servers are managed by enterprise projects, you can select the target enterprise project to view or operate the asset and detection information.

4. Click Container Images and click Repository Images.
   Figure 1 Repository images
   

5. View the repository image information.

   You can view the image version, size, and security risks in the image list.

   In addition, you can perform the following operations:

   • Synchronizing all images

     Click Synchronize All Images to synchronize all types of SWR images. In the upper right corner of the page, click Manage Task and click Image Synchronization to view the progress of image synchronization tasks.

     

     Images can be synchronized only after being authorized by SWR. For details, see SWR Authorization Methods.

   • Filtering images of the latest version

     If you select Display latest image versions only, you can filter the latest images of all images.

   • Viewing image details

     Move the pointer over the target image in the Image column to view Organization and Repository Type. Click the image name to go to the image details page and view the image version, security scan status, and more information.

Scanning Repository Images

You can manually scan images or set a scheduled scan policy to scan them periodically. The scan duration depends on the image size. Generally, a scan can complete within 3 minutes.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Asset Management > Containers & Quota.
4. Click Container Images and click Repository Images.
   Figure 2 Repository images
   

5. Scan images.
   

   • SWR shared images can be scanned only if they are valid.
   • Multi-architecture images do not support manual or scheduled scan.
   • Scanning an image
     1. In the Operation column of an image, click Scan.
     2. Confirm the image information and click OK to start the scan.
   • Manually scanning images
     1. In the upper right corner of the page, click Scan.
     2. Set manual scan parameters. See Manual Scan. For more information, see Table 2.
        Figure 3 Manual scan
        

        Table 2 Manual scan parameters

        Parameter	Description	Example Value
        Risk Type	Select the types of risks to be scanned. HSS scans for software information, file information, and base images by default.	Select all
        Speed Limit for Third-party Image Repositories	If you have a large number of third-party images to be scanned, but you are worried that too much network bandwidth will be occupied if they are all scanned at once, you can click to set the number of images to be scanned per hour.	Unlimited
        Scan Tasks	A scan task occupies one pod. You can set the number of scan tasks running in the cluster. For example, if the number of scan tasks is set to 2, only two scan tasks can run in the cluster.	2
        Image Scope	Select All or specify images. A full scan takes a long time and cannot be stopped after it starts. Exercise caution when performing this operation.	All

     3. Click OK.
   • Scheduling image scans
     1. In the upper right corner of the page, click Scheduled Scan Policy.
     2. Set the scheduled scan parameters, as shown in Figure 4. For details, see Table 3.
        Figure 4 Scheduled scan policy
        

        Table 3 Parameters of a scheduled scan policy

        Parameter	Description	Example Value
        Scheduled Scan Policy	Whether to enable scheduled scan. After this function is enabled, you can view and configure scheduled scan parameters. : disabled : enabled
        Scheduled Scan Period	Click to select the scan period. The scan time range is fixed to 00:00:00 - 07:00:00.	Every 3 days
        Risk Type	Select the types of risks to be scanned. HSS scans for software information, file information, and base images by default.	Select all
        Speed Limit for Third-party Image Repositories	If you have a large number of images to be scanned, but you are worried that too much network bandwidth will be occupied if they are all scanned at once, you can click to set the number of images to be scanned per hour.	Unlimited
        Image Update Time Range	Select a range of image update time. It determines which images will be scanned. For example, if you set the scan time range to Last 15 days, HSS scans only the images updated in the last 15 days.	Last 15 days
        Scan Tasks	A scan task occupies one pod. You can set the number of scan tasks running in the cluster. For example, if the number of scan tasks is set to 2, only two scan tasks can run in the cluster.	2
        Image Repositories	Select the type of the images to be scanned.	Swr-private

     3. Click OK to start the scan.

6. In the upper right corner of the page, click Manage Task and click the Image Scan tab to view image scan task status.

Viewing Image Scan Results

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Asset Management > Containers & Quota.
4. Click Container Images and click Repository Images.
   Figure 5 Repository images
   

5. In the row containing the target image, click View Results in the Operation column to go to the image details page.
6. View image security scan results. For more information, see Table 4.
   Figure 6 Image security report
   

   Table 4 Security report parameters

   Parameter	Description
   Basic Information	Displays basic image information, including the image names, organizations, image tags, image sizes, number of vulnerabilities, last update time of the image tags, and scan status. To rescan image security, click Scan Again.
   Vulnerability Reports	Displays the scan results of image system vulnerabilities and application vulnerabilities. Viewing vulnerability details Click a vulnerability name to go to the vulnerability details page and view the basic information and affected images. Viewing the CVE ID, CVSS Score, and Disclosed Time of a vulnerability Click in front of a vulnerability name to view its CVE ID, CVSS score, and the time when it was disclosed. Viewing vulnerability solutions In the Solution column of a vulnerability, click the solution description to view the vulnerability solution details.
   Malicious Files	Displays the scan results of malicious image files, including the malicious file names, paths, and file sizes.
   Software Information	Displays the statistical results of image software information, including the software names, types, versions, and number of software vulnerabilities. Click next to a software name to view the software vulnerability name, repair urgency, and solution.
   File Information	Displays the statistical results of image file information, including the total number of files, total file size, and details about the top 50 files.
   Unsafe Settings	Displays the image baseline check results, including the configuration check, password complexity policy check, and common weak password check results. Viewing unsafe settings and suggestions On the Unsafe Configurations tab page, select a baseline. In the detection item column of a detection item, click Description to view the detection item description and modification suggestions. Customizing common weak passwords Click Common Weak Password Detection. Configure weak passwords and click OK.
   Sensitive Information	Displays the scan result of sensitive image information, including the risk levels, image paths, file paths, and sensitive information. To add the paths of sensitive files that are not detected, choose Configure Sensitive File Path and add the paths to be filtered. Only Linux system file paths can be filtered. A maximum of 20 paths can be added. Put each path on a separate line. Example: /usr/ or /lib/test.txt.
   Software Compliance	Displays the scan results of non-compliant image software, including the non-compliant software name, software version, path, and image layer information.
   Base Images	Displays the scan results of service images that are not built using basic images. The scan results include image names, versions, and image paths.

Exporting an Image Vulnerability Report or Baseline Report

Vulnerability or baseline report cannot be exported for multi-architecture images.

1. Log in to the management console.
2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
3. In the navigation pane, choose Asset Management > Container Management.
4. Click Container Images and click Repository Images.
   Figure 7 Repository images
   

5. Click Export Vulnerability above the image list and select a report type to export the vulnerability or baseline report.

   If you want to export the vulnerability report of a specified image, select the image type in the search box and click Export Vulnerability.

6. View the export status in the upper part of the container management page. After the export is successful, obtain the exported information from the default file download address on the local host.
   

   Do not close the browser page during the export. Otherwise, the export task will be interrupted.