gcr-vulnerability-scanning

name

gcr-vulnerability-scanning

description

Enable, operate, and triage Google Container Registry / Artifact Registry vulnerability scanning (Container Analysis, continuous and on-demand scans, gcloud findings, CI gates on image digests). Use when GCR CVE scan, Artifact Registry vulnerability scanning, Container Analysis notes/occurrences, gcloud artifacts docker images describe, On-Demand Scanning API, or blocking deploy on CRITICAL/HIGH image vulns in org-owned GCP projects — not Dockerfile authorship alone, Cosign signing, or third-party registry hunting.

GCR Vulnerability Scanning

Operate GCP native container image vulnerability scanning so images in Container Registry (gcr.io) or Artifact Registry are inventoried by digest, scanned, and gated before promote/deploy. Prefer Artifact Registry + Container Analysis (continuous scanning) over legacy-only GCR workflows. Owned or authorized GCP projects only.

Scope And Authorization

• In scope: Org-owned GCR/Artifact Registry repos, Container Analysis notes and occurrences, On-Demand Scanning for CI digests you build, severity policy and exceptions for those projects.
• Out of scope: Scanning third-party private registries without authorization; mass enumeration of foreign gcr.io projects; attacking off-scope systems.
• Prefer metadata/scanner API evidence over bulk unrelated image pulls. Redact SA keys, registry tokens, and sensitive image paths. Org scanner policy and existing CI jobs outrank examples below.

When To Use

• Enable or audit vulnerability scanning on GCR or Artifact Registry
• Read Container Analysis / On-Demand Scanning results for a ship digest
• CI or deploy fail gates on CRITICAL/HIGH package CVEs in GCP-hosted images
• Mentions: GCR scan, Artifact Registry scanning, Container Analysis, gcloud artifacts docker images describe, note/occurrence, Grafeas findings

Do not use as primary for:

Need	Skill instead
Dockerfile multi-stage, non-root, layer secrets	dockerfile-best-practices
Trivy-in-CI severity gates / SARIF (scanner-agnostic CI)	trivy-image-scan-ci
Cosign/Sigstore sign-verify / admission	container-image-signing
SBOM generate/publish / missing-SBOM gate	sbom-ci-enforcement
Broader GCP IAM / SA keys	gcp-iam-basics
GCS public buckets	gcp-storage-public-access
Pipeline topology, OIDC, required checks	ci-cd-pipeline-patterns
Workflow/script quality baseline	code-quality-standards

Workflow

1. Confirm inventory and registry mode

1. Record authorization and project(s). List images that ship to prod.
2. Prefer Artifact Registry; treat legacy gcr.io as migrate or dual-scan.
3. Gate on immutable digests (image@sha256:…) — never :latest alone.

gcloud config get-value project
gcloud artifacts repositories list --location=LOCATION
# Legacy GCR (if still in use):
gcloud container images list --repository=gcr.io/PROJECT

2. Ensure scanning is on

Mode	When	Notes
Continuous (Artifact Registry)	Hosted images	Auto re-scan as DB updates; verify APIs/settings
On-Demand Scanning	CI before push / promote	Scan local/CI digest; attach results for gate
Container Analysis API	Read notes/occurrences	Source of truth for GCP-native findings

Enable Container Analysis API (and On-Demand Scanning if used). CI SAs get least-privilege scan/read only (gcp-iam-basics; keys → secrets-management-hygiene).

3. Fetch findings for the ship digest

IMAGE="LOCATION-docker.pkg.dev/PROJECT/REPO/IMAGE@sha256:DIGEST"
gcloud artifacts docker images describe "$IMAGE" \
  --show-package-vulnerability --format=json

Capture package, installed/fixed version, severity, CVE id, scanner, occurrence time. Multi-arch: index and/or platform digests per org rule.

4. Severity policy and triage

1. Map tool severity → org Critical/High/Med/Low; note OS vs language packages.
2. Prefer base-image refresh and fixed versions over permanent ignores.
3. Exceptions: CVE id + owner + expiry + compensating control; no unbounded mutes.
4. Distinguish unfixed upstream vs reachable app dep; continuous scan may raise new CRITICAL later on the same digest — do not claim permanent “clean.”
5. Neighbors: SBOM → sbom-ci-enforcement; sign → container-image-signing; non-GCP Trivy CI → trivy-image-scan-ci.

5. Gate CI / promote / deploy

1. After build (and push if continuous needs registry presence), resolve digest; poll until occurrences exist when using continuous mode.
2. Fail closed on policy severities for protected envs; report-only only time-boxed.
3. Wire via ci-cd-pipeline-patterns: pin tools, least privilege, no creds in logs, required check name matches branch protection.
4. Apply code-quality-standards to workflow/policy YAML.
5. Verify with a known HIGH/CRITICAL throwaway image; confirm deploy cannot skip.

Routing

Situation	Primary	Helper
GCR/AR CVE scan, Container Analysis, on-demand, digest gates	This skill	—
Trivy image CI / SARIF / .trivyignore outside GCP-native path	trivy-image-scan-ci	this if registry is GCR/AR
Dockerfile / image contents hardening	dockerfile-best-practices	this post-build
SBOM generate, publish, missing-SBOM gates	sbom-ci-enforcement	this for CVE gate
Image sign/verify admission	container-image-signing	this for vuln gate
Project/org IAM, SA keys	gcp-iam-basics	this for scan roles
Pipeline graph, OIDC, required checks	ci-cd-pipeline-patterns	this for scan step
Keys/tokens, leak IR	secrets-management-hygiene	this if registry auth leak
Workflow/policy quality	code-quality-standards	always on CI code

Hand-off: SBOM → sbom-ci-enforcement. Signatures → container-image-signing. Non-GCP Trivy-only gates → trivy-image-scan-ci. This skill owns GCP registry/Container Analysis vuln visibility and gates.

Output Checklist

• Authorization and project(s) recorded; only owned/authorized registries
• Prod images inventoried; gates use digest, not floating tag alone
• Artifact Registry (preferred) or GCR mode documented; APIs enabled
• Continuous and/or on-demand scanning confirmed for ship path
• Findings pulled for ship digest (package, CVE, severity, fixed version)
• Org severity policy applied; exceptions have owner + expiry
• CI/promote fails closed on policy severities for protected envs
• Multi-arch rule documented; registry/SA credentials not logged
• SBOM → sbom-ci-enforcement; sign → container-image-signing; IAM → gcp-iam-basics
• ci-cd-pipeline-patterns + code-quality-standards applied to workflows