Compute
Elastic Cloud Server
Huawei Cloud Flexus
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
FunctionGraph
Cloud Phone Host
Huawei Cloud EulerOS
Networking
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
VPC Endpoint
Cloud Connect
Enterprise Router
Enterprise Switch
Global Accelerator
Management & Governance
Cloud Eye
Identity and Access Management
Cloud Trace Service
Resource Formation Service
Tag Management Service
Log Tank Service
Config
OneAccess
Resource Access Manager
Simple Message Notification
Application Performance Management
Application Operations Management
Organizations
Optimization Advisor
IAM Identity Center
Cloud Operations Center
Resource Governance Center
Migration
Server Migration Service
Object Storage Migration Service
Cloud Data Migration
Migration Center
Cloud Ecosystem
KooGallery
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP Filing
Support Plans
My Credentials
Customer Operation Capabilities
Partner Support Plans
Professional Services
Analytics
MapReduce Service
Data Lake Insight
CloudTable Service
Cloud Search Service
Data Lake Visualization
Data Ingestion Service
GaussDB(DWS)
DataArts Studio
Data Lake Factory
DataArts Lake Formation
IoT
IoT Device Access
Others
Product Pricing Details
System Permissions
Console Quick Start
Common FAQs
Instructions for Associating with a HUAWEI CLOUD Partner
Message Center
Security & Compliance
Security Technologies and Applications
Web Application Firewall
Host Security Service
Cloud Firewall
SecMaster
Anti-DDoS Service
Data Encryption Workshop
Database Security Service
Cloud Bastion Host
Data Security Center
Cloud Certificate Manager
Edge Security
Situation Awareness
Managed Threat Detection
Blockchain
Blockchain Service
Web3 Node Engine Service
Media Services
Media Processing Center
Video On Demand
Live
SparkRTC
MetaStudio
Storage
Object Storage Service
Elastic Volume Service
Cloud Backup and Recovery
Storage Disaster Recovery Service
Scalable File Service Turbo
Scalable File Service
Volume Backup Service
Cloud Server Backup Service
Data Express Service
Dedicated Distributed Storage Service
Containers
Cloud Container Engine
SoftWare Repository for Container
Application Service Mesh
Ubiquitous Cloud Native Service
Cloud Container Instance
Databases
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GeminiDB
GaussDB
Distributed Database Middleware
Database and Application Migration UGO
TaurusDB
Middleware
Distributed Cache Service
API Gateway
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Multi-Site High Availability Service
EventGrid
Dedicated Cloud
Dedicated Computing Cluster
Business Applications
Workspace
ROMA Connect
Message & SMS
Domain Name Service
Edge Data Center Management
Meeting
AI
Face Recognition Service
Graph Engine Service
Content Moderation
Image Recognition
Optical Character Recognition
ModelArts
ImageSearch
Conversational Bot Service
Speech Interaction Service
Huawei HiLens
Video Intelligent Analysis Service
Developer Tools
SDK Developer Guide
API Request Signing Guide
Terraform
Koo Command Line Interface
Content Delivery & Edge Computing
Content Delivery Network
Intelligent EdgeFabric
CloudPond
Intelligent EdgeCloud
Solutions
SAP Cloud
High Performance Computing
Developer Services
ServiceStage
CodeArts
CodeArts PerfTest
CodeArts Req
CodeArts Pipeline
CodeArts Build
CodeArts Deploy
CodeArts Artifact
CodeArts TestPlan
CodeArts Check
CodeArts Repo
Cloud Application Engine
MacroVerse aPaaS
KooMessage
KooPhone
KooDrive

Managing Repository Images

Updated on 2025-01-21 GMT+08:00

Scenario

Repository images include SWR private images, SWR shared images, SWR enterprise images, and third-party images. SWR-related images are synchronized from SWR to HSS. For details about how to access third-party images, see Connecting to a Third-party Image Repository.

HSS scans these images for vulnerabilities, malicious files, software information, file information, baseline configuration, sensitive information, software compliance, and basic image information. For details about the scan items, see Table 1.

You can periodically scan images to detect and clear security risks in a timely manner, improving image security and keeping your assets away from security threats.

Table 1 Image scan items

Item

Description

Vulnerabilities

Detects system and application vulnerabilities in images.

  • System vulnerability scan supports the following OSs:
    • EulerOS 2.2, 2.3, 2.5, 2.8, 2.9, 2.10, 2.11, 2.12 (64-bit)
    • CentOS 7.4, 7.5, 7.6, 7.7, 7.8 and 7.9 (64-bit)
    • Ubuntu 16.04, 18.04, 20.04, 22.04 (64-bit)
    • Debian 9, 10, and 11 (64-bit)
    • Kylin V10 SP1 and SP2 (64-bit)
    • HCE 1.1 and 2.0 (64-bit)
    • SUSE 12 SP5, 15 SP1, and 15 SP2 (64-bit)
    • UnionTech OS V20 server E and V20 server D (64-bit)
  • Application vulnerability scanning supports the following applications: fastjson, log4j-core, log4j-api, spring-core, shiro-core, struts-core, tomcat-embed-el, tomcat-jdbc, tomcat-embed-websocket, tomcat-juli, tomcat-annotations-ap, tomcat-embed-core, spring-jdbc, druid, commons-lang, commons-logging, commons-configuration, commons-collections, spring-cloud-netflix-archaius, mysql-connector-java, tensorflow, bootstrap, json, spring-beans, spring-context, spring-aop and spring-webmvc.

Malicious Files

Detects malicious files in images.

Software Information

Collects software information in an image.

File Information

Collects file information in an image.

Unsafe Settings

  • Configuration check:
    • Checks the images configurations of CentOS 7, Debian 10, EulerOS, and Ubuntu16.
    • Checks SSH configurations.
  • Weak password check: detects weak passwords of Linux (SSH) accounts.
  • Password complexity check: detects insecure password complexity policies in Linux.

Sensitive Information

Detects files that contain sensitive information in images.

  • The paths that are not checked by default are as follows:
    • /usr/*
    • /lib/*
    • /lib32/*
    • /bin/*
    • /sbin/*
    • /var/lib/*
    • /var/log/*
    • AnyPath/node_modules/AnyPath/AnyName.md
    • AnyPath/node_modules/AnyPath/test/AnyPath
    • */service/iam/examples_test.go
    • AnyPath/grafana/public/build/AnyName.js
    NOTE:
    • AnyPath: indicates that the current path is a customized value and can be any path in the system.
    • AnyName: indicates that the file name in the current path is a customized value, which can be any name ended with .md or .js in the system.
    • On the View Report > Sensitive Information tab, click Configure Sensitive File Path to set the Linux paths of the file that do not need to be checked. A maximum of 20 paths can be added.
  • No checks are performed in the following scenarios:
    • The file size is greater than 20 MB.
    • The file type can be binary, common process, or auto generation.

Software Compliance

Detects software and tools that are not allowed to be used.

Base Images

Detects service images that are not created using base images.

Constraints and Limitations

  • Security scans can be performed only on Linux images.

Viewing Repository Image Information

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. In the navigation pane, choose Asset Management > Containers & Quota.

    If your servers are managed by enterprise projects, you can select the target enterprise project to view or operate the asset and detection information.

  4. Click Container Images and click Repository Images.

    Figure 1 Repository images

  5. View the repository image information.

    You can view the image version, size, and security risks in the image list.

    In addition, you can perform the following operations:
    • Synchronizing the latest assets

      You can synchronize the basic information about repository images. This operation will not download SWR images to HSS or download third-party repository images to the jump cluster.

      1. Click Synchronize the Latest Assets, set Sync Type, and click OK.
      2. In the upper right corner of the Containers & Quota page, click Manage Task and click Image Synchronization to view the progress of image synchronization tasks.
      NOTE:

      Images can be synchronized only after being authorized by SWR. For details, see SWR Authorization Methods.

    • Filtering images of the latest version

      If you select Display latest image versions only, you can filter the latest images of all images.

    • Viewing image details

      Move the pointer over the target image in the Image column to view Organization and Repository Type. Click the image name to go to the image details page and view the image version, security scan status, and more information.

Scanning Repository Images

You can manually scan images or set a scheduled scan policy to scan them periodically. The scan duration depends on the image size. Generally, a scan can complete within 3 minutes.

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. In the navigation pane, choose Asset Management > Containers & Quota.
  4. Click Container Images and click Repository Images.

    Figure 2 Repository images

  5. Scan images.

    NOTE:
    • SWR shared images can be scanned only if they are valid.
    • Multi-architecture images do not support manual or scheduled scan.
    • Scanning an image
      1. In the Operation column of an image, click Scan.
      2. Confirm the image information and click OK to start the scan.
    • Manually scanning images
      1. In the upper right corner of the page, click Scan.
      2. Set manual scan parameters. See Manual Scan. For more information, see Table 2.
        Figure 3 Manual scan
        Table 2 Manual scan parameters

        Parameter

        Description

        Example Value

        Risk Type

        Select the types of risks to be scanned. HSS scans for software information, file information, and base images by default.

        Select all

        Speed Limit for Third-party Image Repositories

        If you have a large number of third-party images to be scanned, but you are worried that too much network bandwidth will be occupied if they are all scanned at once, you can click to set the number of images to be scanned per hour.

        Unlimited

        Scan Tasks

        A scan task occupies one pod. You can set the number of scan tasks running in the cluster.

        For example, if the number of scan tasks is set to 2, only two scan tasks can run in the cluster.

        2

        Image Scope

        Select All or specify images. A full scan takes a long time and cannot be stopped after it starts. Exercise caution when performing this operation.

        All

      3. Click OK.
    • Scheduling image scans
      1. In the upper right corner of the page, click Scheduled Scan Policy.
      2. Set the scheduled scan parameters, as shown in Figure 4. For details, see Table 3.
        Figure 4 Scheduled scan policy
        Table 3 Parameters of a scheduled scan policy

        Parameter

        Description

        Example Value

        Scheduled Scan Policy

        Whether to enable scheduled scan. After this function is enabled, you can view and configure scheduled scan parameters.

        • : disabled
        • : enabled

        Scheduled Scan Period

        Click to select the scan period. The scan time range is fixed to 00:00:00 - 07:00:00.

        Every 3 days

        Risk Type

        Select the types of risks to be scanned. HSS scans for software information, file information, and base images by default.

        Select all

        Speed Limit for Third-party Image Repositories

        If you have a large number of images to be scanned, but you are worried that too much network bandwidth will be occupied if they are all scanned at once, you can click to set the number of images to be scanned per hour.

        Unlimited

        Image Update Time Range

        Select a range of image update time. It determines which images will be scanned.

        For example, if you set the scan time range to Last 15 days, HSS scans only the images updated in the last 15 days.

        Last 15 days

        Scan Tasks

        A scan task occupies one pod. You can set the number of scan tasks running in the cluster.

        For example, if the number of scan tasks is set to 2, only two scan tasks can run in the cluster.

        2

        Image Repositories

        Select the type of the images to be scanned.

        Swr-private

      3. Click OK to start the scan.

  1. In the upper right corner of the page, click Manage Task and click the Image Scan tab to view image scan task status.

Viewing Image Scan Results

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. In the navigation pane, choose Asset Management > Containers & Quota.
  4. Click Container Images and click Repository Images.

    Figure 5 Repository images

  5. In the row containing the target image, click View Results in the Operation column to go to the image details page.
  6. View image security scan results. For more information, see Table 4.

    Figure 6 Image security report
    Table 4 Security report parameters

    Parameter

    Description

    Basic Information

    Displays basic image information, including the image names, organizations, image tags, image sizes, number of vulnerabilities, last update time of the image tags, and scan status.

    To rescan image security, click Scan Again.

    Vulnerability Reports

    Displays the scan results of image system vulnerabilities and application vulnerabilities.

    • Viewing vulnerability details

      Click a vulnerability name to go to the vulnerability details page and view the basic information and affected images.

    • Viewing the CVE ID, CVSS Score, and Disclosed Time of a vulnerability

      Click in front of a vulnerability name to view its CVE ID, CVSS score, and the time when it was disclosed.

    • Viewing vulnerability solutions

      In the Solution column of a vulnerability, click the solution description to view the vulnerability solution details.

    Malicious Files

    Displays the scan results of malicious image files, including the malicious file names, paths, and file sizes.

    Software Information

    Displays the statistical results of image software information, including the software names, types, versions, and number of software vulnerabilities.

    Click next to a software name to view the software vulnerability name, repair urgency, and solution.

    File Information

    Displays the statistical results of image file information, including the total number of files, total file size, and details about the top 50 files.

    Unsafe Settings

    Displays the image baseline check results, including the configuration check, password complexity policy check, and common weak password check results.

    • Viewing unsafe settings and suggestions
      1. On the Unsafe Configurations tab page, select a baseline.
      2. In the detection item column of a detection item, click Description to view the detection item description and modification suggestions.
    • Customizing common weak passwords
      1. Click Common Weak Password Detection.
      2. Configure weak passwords and click OK.

    Sensitive Information

    Displays the scan result of sensitive image information, including the risk levels, image paths, file paths, and sensitive information.

    To add the paths of sensitive files that are not detected, choose Configure Sensitive File Path and add the paths to be filtered.

    • Only Linux system file paths can be filtered.
    • A maximum of 20 paths can be added. Put each path on a separate line.
    • Example: /usr/ or /lib/test.txt.

    Software Compliance

    Displays the scan results of non-compliant image software, including the non-compliant software name, software version, path, and image layer information.

    Base Images

    Displays the scan results of service images that are not built using basic images. The scan results include image names, versions, and image paths.

Exporting an Image Vulnerability Report or Baseline Report

Vulnerability or baseline reports cannot be exported for multi-architecture images.

  1. Log in to the management console.
  2. In the upper left corner of the page, select a region, click , and choose Security & Compliance > HSS.
  3. In the navigation pane, choose Asset Management > Container Management.
  4. Click Container Images and click Repository Images.

    Figure 7 Repository images

  5. Click Export Vulnerability above the image list and select a report type to export the vulnerability or baseline report.

    If you want to export the vulnerability report of a specified image, select the image type in the search box and click Export Vulnerability.

  6. View the export status in the upper part of the container management page. After the export is successful, obtain the exported information from the default file download address on the local host.

    NOTICE:

    Do not close the browser page during the export. Otherwise, the export task will be interrupted.

We use cookies to improve our site and your experience. By continuing to browse our site you accept our cookie policy. Find out more

Feedback

Feedback

Feedback

0/500

Selected Content

Submit selected content with the feedback