Container Security Policies
Container Security policies identify security risks in container images and their underlying components. The policies evaluate dependencies introduced through base images, operating system layers, user code, and build instructions, as well as configuration settings and sensitive data embedded in containers.
Identifying vulnerabilities, misconfigurations, and policy violations early helps reduce supply chain risk and limits the likelihood of insecure images being deployed into runtime environments.
The article describes the policies in this category, configuration options, and the impact of policy violations. For an overview of policies and policy management, see the Policies article.
View and manage Container Security policies
Open each policy to view the business impact and optional settings.
Deprecated dependency in container from user code or instruction
Purpose: Identifies deprecated libraries introduced into container images through user code or build instructions.
Business impact: Deprecated libraries are no longer maintained and may not receive security fixes, increasing the risk of vulnerabilities and instability. Continuing to use deprecated dependencies can expose containerized applications to known security issues and operational risk.
ON/OFF (toggle)
Enable/disable the policy.
ON
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Malicious dependency in container
Purpose: Detects third-party libraries or packages embedded in container images that contain malicious code.
Business impact: Malicious dependencies can be exploited to steal data, execute remote code, enable lateral movement, or take over underlying systems. These dependencies may be introduced through techniques such as typosquatting, dependency confusion, or compromised repositories, increasing the risk of severe security breaches in containerized environments.
For more on this policy, see the article Malicious Dependencies.
ON/OFF (toggle)
Enable/disable the policy.
OFF
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Misconfiguration in container
Purpose: Identifies insecure or non-compliant configuration settings in container images and container runtime settings.
When enabling this policy, any container misconfiguration with a severity higher than the set limit triggers a security issue.
Business impact: Container misconfigurations can introduce security vulnerabilities that expose applications and infrastructure to attack. Issues related to base images, user permissions, network access, or file system settings can be exploited to gain unauthorized access or compromise running services, leading to severe business and security impacts.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Outdated dependency in container from user code or instruction
Purpose: Identifies libraries introduced into container images through user code or build instructions that are not using current versions.
When enabling this policy, any container misconfiguration with a severity higher than the set limit triggers a security issue.
Business impact: Outdated libraries may miss important security fixes and improvements available in newer versions. Continuing to use outdated dependencies increases exposure to known vulnerabilities and reduces the overall security and reliability of containerized applications.
ON/OFF (toggle)
Enable/disable the policy.
OFF
Compare
When a major version is selected, there will be no violation if the latest version of a library is just a minor version change.
Current setting
Major version draft
Major Version Drift
A violation will occur only if the difference between the latest major version and the deployed major version is more than or equal to the drift.
Current setting
Days since update
Days that a library that has a newer version can remain without being updated.
Current setting
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Pll in container
Purpose: Detects hardcoded personally identifiable information (PII) present within container images.
Business impact: Storing PII in container images increases the risk of data exposure and privacy violations. If container images are shared, reused, or accessed without proper controls, exposed PII may lead to regulatory non-compliance and loss of user trust.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Secret in container
Purpose: Detects hardcoded secrets in container images or exposed through insecure container configuration.
Business impact: Embedded or misconfigured secrets in container environments can expose sensitive information and enable unauthorized access. If secrets are included directly in images or improperly protected, attackers may exploit them to access systems or data, increasing the risk of breaches and loss of confidentiality.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Generate issue for base image secrets (toggle)
Enable/disable
ON
Unapproved dependency license in container from user code or instruction
Purpose: Sets specific licenses that are approved for usage in open-source libraries. This policy will detect if any open-source library introduced into container images through user code or build instructions violates these settings.
Users can configure a list of approved licenses OR unapproved licenses
When this policy is enabled, any license not in the approved list is considered unapproved.
Business impact: Using dependencies with unapproved licenses in containers can create legal and compliance risks. License terms may conflict with organizational policies or legal obligations, potentially leading to intellectual property disputes or financial liability.
ON/OFF (toggle)
Enable/disable the policy.
OFF
Approved licenses (SPDX format)
Add/remove licenses.
Use the SPDX format to add.
Current setting
Not approved licenses (SPDX format)
Add/remove licenses.
Use the SPDX format to add.
Current setting
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Unpopular dependency in container from user code or instruction
Purpose: Sets minimal popularity metrics (stars/downloads/forks) for libraries introduced into container images through user code or build instructions. When enabling this policy, any library detected with less than the set limit will trigger a security issue.
Business impact: Libraries with very few users are less likely to be actively reviewed, maintained, or tested, which can increase security and stability risks. Using widely adopted libraries is generally safer, as they tend to be more stable and receive more frequent updates and community scrutiny.
ON/OFF (toggle)
Enable/disable the policy.
OFF
Stars count
Minimum number of stars.
Policy violation occurs only when all arguments (forks, stars, and downloads, if available) are violated.
Current setting
Downloads count
Minimum number of downloads.
Policy violation occurs only when all arguments (forks, stars, and downloads if available) are violated.
Current setting
Forks counts
Minimum number of forks.
Policy violation occurs only when all arguments (forks, stars, and downloads, if available) are violated.
Current setting
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Vulnerable dependency (CVE) in container from base image
Purpose: Detects known vulnerabilities in dependencies inherited from the container base image. When enabled, any CVE detected in a base image’s dependency with a severity higher than the set limit triggers a security issue.
Business impact: Base images often include operating system components and libraries that applications rely on to run. Vulnerabilities in these foundational components can be inherited by all containers built from the image, increasing the attack surface and risk of exploitation. Identifying base image vulnerabilities early helps ensure containers are built on secure, up-to-date foundations.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Vulnerable dependency (CVE) in container from operating system
Purpose: Detects known operating system vulnerabilities present in the operating system layer of container images. When enabling this policy, any CVE detected in the container’s operating system with a severity higher than the set limit will trigger a security issue.
Business impact: Containers rely on an underlying operating system layer that may include outdated, vulnerable, or misconfigured components. Vulnerabilities at the OS level can increase the attack surface and be exploited to compromise containerized workloads. Identifying and addressing OS-level vulnerabilities helps reduce risk and strengthens the security posture of container environments.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Vulnerable dependency (CVE) in container from user code
Purpose: Detects known vulnerabilities in open-source libraries introduced into container images through user application code.
Business impact: Containers often include open-source libraries that may contain known vulnerabilities. If these vulnerabilities are not identified, they can be exploited to gain unauthorized access, expose data, or compromise systems. As the use of containers and open-source components increases, unaddressed vulnerabilities can significantly raise security risk.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Vulnerable dependency (CVE) in container from user instruction
Purpose: Detects known vulnerabilities in open-source libraries introduced into container images through user-defined build instructions in the Dockerfile. When enabling this policy, any CVE detected in the container’s dockerfile instructions with a severity higher than the set limit will trigger a security issue.
Business impact: Dependencies added through Dockerfile instructions may include open-source libraries with known vulnerabilities. If these vulnerabilities are not identified, they can be exploited to gain unauthorized access, expose data, or compromise containerized workloads. As container builds increasingly rely on custom instructions, unscanned dependencies can significantly increase security risk.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Vulnerable dependency (CVE) in Java archive package
Purpose: Detects known vulnerabilities in Java archive (JAR) packages included in container images.
When enabled, any CVE detected in a dependency located in a JAR artifact with a severity higher than the set limit triggers a security issue.
Business impact: Java archive packages may contain critical security flaws that can be exploited if left unaddressed. Failing to identify vulnerabilities in these components can lead to unauthorized access, data exposure, and broader application compromise.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Ignore Application Business Priority for severity calculation (checkbox)
When enabled, severity is not adjusted based on application priority.
OFF
Vulnerable dependency (CVE) in public image hosted in private registry
Purpose: Detects known vulnerabilities in public container images that are hosted or mirrored in private registries.
When enabled, any CVE detected in a privately hosted public image with a severity higher than the set limit triggers a security issue.
Business impact: Public images hosted on private registries may contain vulnerable dependencies that can be exploited. Failing to identify these vulnerabilities increases the risk of security breaches and operational disruption, even when images are stored in internal registries.
ON/OFF (toggle)
Enable/disable the policy.
ON
Show issues of severity (dropdown)
Limits which severities appear as issues.
All (including Info)
Open the Active Issues page.
Use the Category filter and select the policy category to view related active issues.
Use the Policy filter to narrow the list to a specific policy.
Apply the Category and Policy filters separately or together, depending on how specific you want the results to be.
Use the search box to refine results, such as filtering by file name, keyword, or rule identifier.
When you change a policy’s severity, ON/OFF toggle or any other setting, you must save the current profile or create a new one.
To save the current profile, click SAVE in the page header.
To create a new profile, click SAVE AS in the page header. For instructions, see the section Create or edit policy profiles in the Policies article.
Last updated