Using vulnerability scanning to detect threats

Artifact Registry provides vulnerability scanning in the Artifact Analysis service, to help detect security vulnerabilities and protect your containers from threats.

In this section, you’ll run an on-demand scan, and then view the results in the Google Cloud console. Automatic scanning is also available but is not discussed in this chapter.

Running an on-demand scan of your container image

You can run on-demand scans synchronously or asynchronously. Scans can take a considerable amount of time, so asynchronous can be a better choice in some cases.

There are two parts to the on-demand scan. There’s the scan and then there’s the retrieval and viewing of results. In this exercise, the Docker container uploaded into Artifact Registry earlier will be used for an on-demand scan.

Run the following command to perform a vulnerability scan on our container image:

gcloud artifacts docker images scan \
us-central1...