Question

Your team builds container images in Cloud Build and pushes them to Artifact Registry. Security requires that every image be automatically scanned for OS-level vulnerabilities as soon as it is stored, and that developers be able to query the findings without running any additional scanning jobs in the pipeline. You want the least-effort, native approach. What should you do?

Accepted Answer

Enable the Container Scanning API so Artifact Registry automatically scans images on push and stores vulnerability findings that can be queried via the API or console.

Answer

Add a Cloud Build step that runs an open-source scanner like Trivy against each image and uploads the results to Cloud Storage for developers to download.

Answer

Configure Binary Authorization with a vulnerability policy so that scanning occurs automatically during admission to the cluster.

Answer

Schedule a Cloud Scheduler job that periodically pulls all images from Artifact Registry and runs the gcloud artifacts docker images scan command on each.