# Container Security Policies Container Security policies identify security risks in container images and their underlying components. The policies evaluate dependencies introduced through base images, operating system layers, user code, and build instructions, as well as configuration settings and sensitive data embedded in containers. Identifying vulnerabilities, misconfigurations, and policy violations early helps reduce supply chain risk and limits the likelihood of insecure images being deployed into runtime environments. The article describes the policies in this category, configuration options, and the impact of policy violations. For an overview of policies and policy management, see the [Policies ](https://docs.ox.security/ox-policies)article.

## View and manage Container Security policies Open each policy to view the business impact and optional settings.

Deprecated dependency in container from user code or instruction

> **Note:** This capability is currently in Early Access (EA) and is not generally available. To request access, please contact OX technical support. **Purpose:** Identifies deprecated libraries introduced into container images through user code or build instructions. **Business impact:** Deprecated libraries are no longer maintained and may not receive security fixes, increasing the risk of vulnerabilities and instability. Continuing to use deprecated dependencies can expose containerized applications to known security issues and operational risk.

Setting

Description

Default

ON/OFF (toggle)

Enable/disable the policy.

Ignore Application Business Priority for severity calculation (checkbox)

When enabled, severity is not adjusted based on application priority.

OFF

Malicious dependency in container

**Purpose:** Detects third-party libraries or packages embedded in container images that contain malicious code. **Business impact:** Malicious dependencies can be exploited to steal data, execute remote code, enable lateral movement, or take over underlying systems. These dependencies may be introduced through techniques such as typosquatting, dependency confusion, or compromised repositories, increasing the risk of severe security breaches in containerized environments. For more on this policy, see the article [Malicious Dependencies](https://docs.ox.security/ox-policies/malicious-dependencies).

Setting

Description

Default

ON/OFF (toggle)

Enable/disable the policy.

OFF

Ignore Application Business Priority for severity calculation (checkbox)

When enabled, severity is not adjusted based on application priority.

OFF

Misconfiguration in container

**Purpose:** Identifies insecure or non-compliant configuration settings in container images and container runtime settings. When enabling this policy, any container misconfiguration with a severity higher than the set limit triggers a security issue. **Business impact:** Container misconfigurations can introduce security vulnerabilities that expose applications and infrastructure to attack. Issues related to base images, user permissions, network access, or file system settings can be exploited to gain unauthorized access or compromise running services, leading to severe business and security impacts.

Setting

Description

Default

ON/OFF (toggle)

Enable/disable the policy.

Show issues of severity (dropdown)

Limits which severities appear as issues.

All (including Info)

Ignore Application Business Priority for severity calculation (checkbox)

When enabled, severity is not adjusted based on application priority.

OFF

Outdated dependency in container from user code or instruction

**Purpose:** Identifies libraries introduced into container images through user code or build instructions that are not using current versions. When enabling this policy, any container misconfiguration with a severity higher than the set limit triggers a security issue. **Business impact:** Outdated libraries may miss important security fixes and improvements available in newer versions. Continuing to use outdated dependencies increases exposure to known vulnerabilities and reduces the overall security and reliability of containerized applications.

Setting	Description	Default
ON/OFF (toggle)	Enable/disable the policy.	OFF
Compare	When a major version is selected, there will be no violation if the latest version of a library is just a minor version change.	Current setting
Major version draft	Major Version Drift A violation will occur only if the difference between the latest major version and the deployed major version is more than or equal to the drift.	Current setting
Days since update	Days that a library that has a newer version can remain without being updated.	Current setting
Ignore Application Business Priority for severity calculation (checkbox)	When enabled, severity is not adjusted based on application priority.	OFF

Pll in container

**Purpose:** Detects hardcoded personally identifiable information (PII) present within container images. **Business impact:** Storing PII in container images increases the risk of data exposure and privacy violations. If container images are shared, reused, or accessed without proper controls, exposed PII may lead to regulatory non-compliance and loss of user trust.

Setting	Description	Default
ON/OFF (toggle)	Enable/disable the policy.	ON
Show issues of severity (dropdown)	Limits which severities appear as issues.	All (including Info)

Secret in container

**Purpose:** Detects hardcoded secrets in container images or exposed through insecure container configuration. **Business impact:** Embedded or misconfigured secrets in container environments can expose sensitive information and enable unauthorized access. If secrets are included directly in images or improperly protected, attackers may exploit them to access systems or data, increasing the risk of breaches and loss of confidentiality.

Setting	Description	Default
ON/OFF (toggle)	Enable/disable the policy.	ON
Show issues of severity (dropdown)	Limits which severities appear as issues.	All (including Info)
Ignore Application Business Priority for severity calculation (checkbox)	When enabled, severity is not adjusted based on application priority.	OFF
Generate issue for base image secrets (toggle)	Enable/disable	ON

Unapproved dependency license in container from user code or instruction

**Purpose:** Sets specific licenses that are approved for usage in open-source libraries. This policy will detect if any open-source library introduced into container images through user code or build instructions violates these settings. * Users can configure a list of approved licenses OR unapproved licenses * When this policy is enabled, any license not in the approved list is considered unapproved. **Business impact: Using** dependencies with unapproved licenses in containers can create legal and compliance risks. License terms may conflict with organizational policies or legal obligations, potentially leading to intellectual property disputes or financial liability.

Setting	Description	Default
ON/OFF (toggle)	Enable/disable the policy.	OFF
Approved licenses (SPDX format)	Add/remove licenses. Use the SPDX format to add.	Current setting
Not approved licenses (SPDX format)	Add/remove licenses. Use the SPDX format to add.	Current setting
Ignore Application Business Priority for severity calculation (checkbox)	When enabled, severity is not adjusted based on application priority.	OFF

Unpopular dependency in container from user code or instruction

**Purpose:** Sets minimal popularity metrics (stars/downloads/forks) for libraries introduced into container images through user code or build instructions. When enabling this policy, any library detected with less than the set limit will trigger a security issue. **Business impact:** Libraries with very few users are less likely to be actively reviewed, maintained, or tested, which can increase security and stability risks. Using widely adopted libraries is generally safer, as they tend to be more stable and receive more frequent updates and community scrutiny.

Setting	Description	Default
ON/OFF (toggle)	Enable/disable the policy.	OFF
Stars count	Minimum number of stars. Policy violation occurs only when all arguments (forks, stars, and downloads, if available) are violated.	Current setting
Downloads count	Minimum number of downloads. Policy violation occurs only when all arguments (forks, stars, and downloads if available) are violated.	Current setting
Forks counts	Minimum number of forks. Policy violation occurs only when all arguments (forks, stars, and downloads, if available) are violated.	Current setting
Ignore Application Business Priority for severity calculation (checkbox)	When enabled, severity is not adjusted based on application priority.	OFF

Vulnerable dependency (CVE) in container from base image

**Purpose**: Detects known vulnerabilities in dependencies inherited from the container base image. When enabled, any CVE detected in a base image’s dependency with a severity higher than the set limit triggers a security issue. **Business impact: Base** images often include operating system components and libraries that applications rely on to run. Vulnerabilities in these foundational components can be inherited by all containers built from the image, increasing the attack surface and risk of exploitation. Identifying base image vulnerabilities early helps ensure containers are built on secure, up-to-date foundations.

Setting

Description

Default

ON/OFF (toggle)

Enable/disable the policy.

Show issues of severity (dropdown)

Limits which severities appear as issues.

All (including Info)

Ignore Application Business Priority for severity calculation (checkbox)

When enabled, severity is not adjusted based on application priority.

OFF

Vulnerable dependency (CVE) in container from operating system

**Purpose:** Detects known operating system vulnerabilities present in the operating system layer of container images. When enabling this policy, any CVE detected in the container’s operating system with a severity higher than the set limit will trigger a security issue. **Business impact:** Containers rely on an underlying operating system layer that may include outdated, vulnerable, or misconfigured components. Vulnerabilities at the OS level can increase the attack surface and be exploited to compromise containerized workloads. Identifying and addressing OS-level vulnerabilities helps reduce risk and strengthens the security posture of container environments.

Setting

Description

Default

ON/OFF (toggle)

Enable/disable the policy.

Show issues of severity (dropdown)

Limits which severities appear as issues.

All (including Info)

Ignore Application Business Priority for severity calculation (checkbox)

When enabled, severity is not adjusted based on application priority.

OFF

Vulnerable dependency (CVE) in container from user code

**Purpose:** Detects known vulnerabilities in open-source libraries introduced into container images through user application code. **Business impact:** Containers often include open-source libraries that may contain known vulnerabilities. If these vulnerabilities are not identified, they can be exploited to gain unauthorized access, expose data, or compromise systems. As the use of containers and open-source components increases, unaddressed vulnerabilities can significantly raise security risk.

Setting

Description

Default

ON/OFF (toggle)

Enable/disable the policy.

Show issues of severity (dropdown)

Limits which severities appear as issues.

All (including Info)

Ignore Application Business Priority for severity calculation (checkbox)

When enabled, severity is not adjusted based on application priority.

OFF

Vulnerable dependency (CVE) in container from user instruction

**Purpose:** Detects known vulnerabilities in open-source libraries introduced into container images through user-defined build instructions in the Dockerfile. When enabling this policy, any CVE detected in the container’s dockerfile instructions with a severity higher than the set limit will trigger a security issue. **Business impact:** Dependencies added through Dockerfile instructions may include open-source libraries with known vulnerabilities. If these vulnerabilities are not identified, they can be exploited to gain unauthorized access, expose data, or compromise containerized workloads. As container builds increasingly rely on custom instructions, unscanned dependencies can significantly increase security risk.

Setting

Description

Default

ON/OFF (toggle)

Enable/disable the policy.

Show issues of severity (dropdown)

Limits which severities appear as issues.

All (including Info)

Ignore Application Business Priority for severity calculation (checkbox)

When enabled, severity is not adjusted based on application priority.

OFF

Vulnerable dependency (CVE) in Java archive package

**Purpose:** Detects known vulnerabilities in Java archive (JAR) packages included in container images. When enabled, any CVE detected in a dependency located in a JAR artifact with a severity higher than the set limit triggers a security issue. **Business impact:** Java archive packages may contain critical security flaws that can be exploited if left unaddressed. Failing to identify vulnerabilities in these components can lead to unauthorized access, data exposure, and broader application compromise.

Setting

Description

Default

ON/OFF (toggle)

Enable/disable the policy.

Show issues of severity (dropdown)

Limits which severities appear as issues.

All (including Info)

Ignore Application Business Priority for severity calculation (checkbox)

When enabled, severity is not adjusted based on application priority.

OFF

Vulnerable dependency (CVE) in public image hosted in private registry

**Purpose: Detects** known vulnerabilities in public container images that are hosted or mirrored in private registries. When enabled, any CVE detected in a privately hosted public image with a severity higher than the set limit triggers a security issue. **Business impact: Public** images hosted on private registries may contain vulnerable dependencies that can be exploited. Failing to identify these vulnerabilities increases the risk of security breaches and operational disruption, even when images are stored in internal registries.

Setting	Description	Default
ON/OFF (toggle)	Enable/disable the policy.	ON
Show issues of severity (dropdown)	Limits which severities appear as issues.	All (including Info)

## View policy issues 1. Open the Active Issues page. 2. Use the **Category** filter and select the policy category to view related active issues. 3. Use the **Policy** filter to narrow the list to a specific policy. 4. Apply the Category and Policy filters separately or together, depending on how specific you want the results to be. 5. Use the search box to refine results, such as filtering by file name, keyword, or rule identifier. ## Create or save policy profiles When you change a policy’s severity, ON/OFF toggle or any other setting, you must save the current profile or create a new one. * To save the current profile, click **SAVE** in the page header. * To create a new profile, click **SAVE AS** in the page header. For instructions, see the section [Create or edit policy profiles ](https://open-2c.gitbook.com/url/preview/site_RHimt/~/revisions/esBak1HVuTgsCEeNbzHE/policies?theme=light#create-or-edit-policy-profiles)in the [Policies ](https://docs.ox.security/ox-policies/policies)article.