Managing Registry Settings: Immutability and Vulnerability Scanning
PreviousSetting Up Replication Rules for Your Container RegistryNextDeleting a Container Registry in AceCloud
Last updated
The Settings tab in Ace Container Registry allows you to configure two critical security features: immutability rules and vulnerability scanning. These settings help ensure the security and integrity of your container images.
Log in to the AceCloud Console.
Select your Project and Region.
Navigate to Container Registry.
Click Overview.
Select the Settings tab.
Locate the Vulnerability Scanning section.
Check the Enable Vulnerability Scanning box.
a. When enabled, each newly pushed image is automatically scanned for known security issues.
Save the settings.
Tip: Regularly review scan results in the Repositories tab to track vulnerabilities and remediation needs.
Immutability ensures that once a tag is pushed, it cannot be overwritten. This prevents accidental or malicious overwrites of critical images.
In the Settings tab, go to Immutability Rules.
Click Create Rule.
Define the conditions for immutability:
a. Repository Matching: Specify the repositories where the rule applies.
b. Tag Matching / Excluding: Define tag patterns that should be protected.
Use * to match any sequence of characters in a single level.
Example: frontend-* matches frontend-api, frontend-ui.
Use ** to match recursively across multiple levels.
Example: **/release matches prod/release, dev/backend/release.
Save the rule.
The rule will now enforce immutability on matching repositories/tags.
Immutability + Replication: Combine immutability rules with replication rules for secure, consistent image management.
Scanning Performance: Enabling vulnerability scanning may add processing overhead, but it significantly improves security posture.
One Registry Per Project/Region: Remember that each project can only have one registry per region.
Last updated