Vulnerability Scanning

Harbor provides static analysis of vulnerabilities in images through the open source projects Trivy and Clair. To be able to use Trivy, Clair or both you must have enabled Trivy, Clair or both when you installed your Harbor instance (by appending installation options --with-trivy, --with-clair or both).

Currently, Harbor supports only one system default scanner. The following principles will be applied to determine the system default scanner among the default installed scanners.

For a brand new installation:

If no scanner is installed, no system default scanner will be set then;

If only one scanner (either Trivy or Clair) is installed, the installed one will become the system default scanner automatically;

If both Trivy and Clair are installed, Trivy will be the system default scanner then.

For upgrades:

If the upgrading path is from the version that is >=V1.10 to current version (V2.0) and there was an existing system default scanner “ABC” is set in the previous version, that scanner “ABC” will be kept as system default scanner;

Otherwise, Harbor will do the similar operation to the above brand new installation case.

You can also connect Harbor to your own instance of Trivy/Clair or to other additional vulnerability scanners through Harbor’s embedded interrogation service. These scanners can be configured in the Harbor UI at any time after installation. For the list of additional scanners that are currently supported, see the Harbor Compatibility List.

It might be necessary to connect Harbor to other scanners for corporate compliance reasons, or because your organization already uses a particular scanner. Different scanners also use different vulnerability databases, capture different CVE sets, and apply different severity thresholds. By connecting Harbor to more than one vulnerability scanner, you broaden the scope of your protection against vulnerabilities.

For information about installing Harbor with Clair, see the Run the Installer Script.

You can manually initiate scanning on a particular image, or on all images in Harbor. Additionally, you can also set a policy to automatically scan all of the images at specific intervals.

Pages in this section

Contributing

Page source Create issue