Trivy Security Scanner
Harbor provides static analysis of vulnerabilities in images through the open source project Trivy (Aqua Security).
When you run vulnerability scans, images that are subject to Common Vulnerabilities and Exposures (CVE) are identified.
Severity levels
| CRITICAL | At least one critical vulnerability found |
| HIGH | At least one high level vulnerability found |
| MEDIUM | At least one medium level vulnerability found |
| LOW | At least one low level vulnerability found |
| NEGLIGIBLE | No vulnerabilities found |
| UNKNOWN | Unknown vulnerabilities |
Scan individual artifacts
Log in to Harbor with an account that has at least project admin privileges.
Go to Projects, select a project, and then click the Scanner tab.
- The Scanner tab shows Trivy details:
To see the vulnerabilities detected in repository artifacts, click the Repositories tab and then click on a repository. For each artifact in the repository, the Vulnerabilities column displays the vulnerability scanning status and related information.
- To run a vulnerability scan, select the artifacts to scan and then click the Scan button. You can optionally select the checkbox at the top to select all artifacts in the repository.
- To see a summary of the vulnerability report, hover over the number of fixable vulnerabilities.
- To see a detailed vulnerability report, click on the artifact digest. In addition to information about the artifact, all of the vulnerabilities found in the last scan are listed. You can sort or filter the list by the different columns. You can also click Scan in the report page to run a scan on this artifact.
Scan on push
With Harbor it is possible to scan images automatically after they have been pushed. This is automatically enabled at project level since DevOps Portal 1.7.0.
- Log in to Harbor with an account that has at least project admin privileges.
- Go to your project repository and select the tab ... > Configuration.
- See the checkmark "Automatically scan images on push" which has been set by the DevOps Portal in the screenshot below.
CVE allowlist
You can create allowlists of CVEs to ignore them during vulnerability scanning.
- Log in to Harbor with an account that has at least project admin privileges.
- Go to your project repository and select the tab ... > Configuration.
- "CVE allowlist" and an expiration date can be configured by adding specific CVE ID's:
Additional information
Further documentation about vulnerability scanning can be found at https://goharbor.io/docs/2.7.0/administration/vulnerability-scanning