Skip to content
代码片段 群组 项目
未验证 提交 06d2a6d2 编辑于 作者: Aditya Tiwari's avatar Aditya Tiwari 提交者: GitLab
浏览文件

Move document for CS for registry

Move document for CS for registry from CVS to CS page.
Update name to container scanning for registry.

Changelog: added
EE: true
上级 ed63e4eb
No related branches found
No related tags found
无相关合并请求
...@@ -60,8 +60,8 @@ You can configure the following security controls: ...@@ -60,8 +60,8 @@ You can configure the following security controls:
- Select **Configure with a merge request** to create a merge request with the changes required to - Select **Configure with a merge request** to create a merge request with the changes required to
enable Container Scanning. For more details, see enable Container Scanning. For more details, see
[Enable Container Scanning through an automatic merge request](../container_scanning/index.md#enable-container-scanning-through-an-automatic-merge-request). [Enable Container Scanning through an automatic merge request](../container_scanning/index.md#enable-container-scanning-through-an-automatic-merge-request).
- [Continuous Container Scanning](../container_scanning/index.md) - [Container Scanning For Registry](../container_scanning/index.md#container-scanning-for-registry)
- Continuous container scanning runs in the registry when any image or database is updated. For more details, read [Continuous container scanning](../../../user/application_security/continuous_vulnerability_scanning/index.md#continuous-vulnerability-scanning-for-container-registry). - Enable toggle to configure **Container Scanning For Registry** for the current project.
- [Operational Container Scanning](../../clusters/agent/vulnerabilities.md) - [Operational Container Scanning](../../clusters/agent/vulnerabilities.md)
- Can be configured by adding a configuration block to your agent configuration. For more details, read [Operational Container Scanning](../../clusters/agent/vulnerabilities.md#enable-operational-container-scanning). - Can be configured by adding a configuration block to your agent configuration. For more details, read [Operational Container Scanning](../../clusters/agent/vulnerabilities.md#enable-operational-container-scanning).
- [Secret Detection](../secret_detection/pipeline/index.md) - [Secret Detection](../secret_detection/pipeline/index.md)
......
...@@ -692,6 +692,31 @@ This report can be viewed in the [Dependency List](../dependency_list/index.md). ...@@ -692,6 +692,31 @@ This report can be viewed in the [Dependency List](../dependency_list/index.md).
You can download CycloneDX SBOMs [the same way as other job artifacts](../../../ci/jobs/job_artifacts.md#download-job-artifacts). You can download CycloneDX SBOMs [the same way as other job artifacts](../../../ci/jobs/job_artifacts.md#download-job-artifacts).
## Container Scanning For Registry
DETAILS:
**Tier:** Ultimate
**Offering:** GitLab.com, Self-managed, GitLab Dedicated
> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/2340) in GitLab 17.1 [with a flag](../../../administration/feature_flags.md) named `container_scanning_for_registry_flag`. Disabled by default.
FLAG:
The availability of this feature is controlled by a feature flag.
For more information, see the history.
When an image is pushed with the `latest` tag, a container scanning job is automatically triggered against the default branch of the project.
Unlike regular Container Scanning, the scan results do not include a security report. Instead, Container Scanning for Registry relies on [Continuous Vulnerability Scanning](../continuous_vulnerability_scanning/index.md) to inspect the components detected by the scan.
When security findings are identified, GitLab generates vulnerabilities in the project. These vulnerabilities can be viewed under `Container registry vulnerabilities` tab on the [Vulnerability Report](../vulnerability_report/index.md) page.
By default there is a limit of `50` scans per project per day.
### Prerequisites
- Ensure that the security configuration [Container Scanning For Registry](../configuration#security-testing) is enabled.
- The project must contain a repository. Note that if you are utilizing an empty project solely for storing container images, this feature won't function as intended. As a workaround, ensure the project has an initial commit on the default branch.
## Security Dashboard ## Security Dashboard
The [Security Dashboard](../security_dashboard/index.md) shows you an overview of all The [Security Dashboard](../security_dashboard/index.md) shows you an overview of all
......
...@@ -57,6 +57,7 @@ never considered as affected because this might result in false negatives. ...@@ -57,6 +57,7 @@ never considered as affected because this might result in false negatives.
GitLab offers security analyzers that can generate a [CycloneDX SBOM report](../../../ci/yaml/artifacts_reports.md#artifactsreportscyclonedx) compatible with GitLab: GitLab offers security analyzers that can generate a [CycloneDX SBOM report](../../../ci/yaml/artifacts_reports.md#artifactsreportscyclonedx) compatible with GitLab:
- [Container Scanning](../container_scanning/index.md#configuration) - [Container Scanning](../container_scanning/index.md#configuration)
- [Container Scanning For Registry](../container_scanning/index.md#container-scanning-for-registry)
- [Dependency Scanning](../dependency_scanning/index.md#configuration) - [Dependency Scanning](../dependency_scanning/index.md#configuration)
- [Android dependency scanning CI/CD component](https://gitlab.com/explore/catalog/components/android-dependency-scanning) (experimental) - [Android dependency scanning CI/CD component](https://gitlab.com/explore/catalog/components/android-dependency-scanning) (experimental)
...@@ -86,28 +87,3 @@ Current data sources for security advisories include: ...@@ -86,28 +87,3 @@ Current data sources for security advisories include:
To find a vulnerability, you can search the [`GitLab Advisory Database`](https://advisories.gitlab.com/). To find a vulnerability, you can search the [`GitLab Advisory Database`](https://advisories.gitlab.com/).
You can also [submit new vulnerabilities](https://gitlab.com/gitlab-org/security-products/gemnasium-db/blob/master/CONTRIBUTING.md). You can also [submit new vulnerabilities](https://gitlab.com/gitlab-org/security-products/gemnasium-db/blob/master/CONTRIBUTING.md).
## Continuous Vulnerability Scanning For Container Registry
DETAILS:
**Tier:** Ultimate
**Offering:** GitLab.com, Self-managed, GitLab Dedicated
> - [Introduced](https://gitlab.com/groups/gitlab-org/-/epics/2340) in GitLab 17.1 [with a flag](../../../administration/feature_flags.md) named `container_scanning_for_registry_flag`. Disabled by default.
FLAG:
The availability of this feature is controlled by a feature flag.
For more information, see the history.
Continuous Vulnerability Scanning For Container Registry identifies security vulnerabilities in Docker images stored in the [GitLab Container Registry](../../packages/container_registry/index.md), specifically those tagged as `latest`.
When an image is pushed with the `latest` tag, a container scanning job is automatically triggered against the default branch of the project.
As security advisories are added or updated, this feature actively scans the Docker images in the Container Registry, identifies any affected images, and generates vulnerabilities in the project.
By default there is a limit of `50` scans per project per day.
### Prerequisites
- Ensure that the security configuration [Container Scanning For Registry](../configuration#security-testing) is enabled.
- The project must contain a repository. Note that if you are utilizing an empty project solely for storing container images, this feature won't function as intended. As a workaround, ensure the project has an initial commit on the default branch.
0% 加载中 .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册