Setting Up Automated Image Scanning

Every image pushed to FastPanel Registry is automatically scanned for known CVEs. Here's how the scanning works and how to integrate results into your CI pipeline.

How scanning works

We run Trivy against every image layer on push. Results are available via API within 60 seconds for most images. For large images (5GB+) allow up to 5 minutes.

Blocking builds on critical vulnerabilities

Add this step to your GitHub Actions or GitLab CI:

- name: Check scan results
  run: |
    STATUS=$(curl -s -H "Authorization: Bearer $FP_TOKEN"       "https://api.fastpanel.app/v2/registry/images/$IMAGE_ID/scan"       | jq -r '.status')
    
    CRITICAL=$(curl -s -H "Authorization: Bearer $FP_TOKEN"       "https://api.fastpanel.app/v2/registry/images/$IMAGE_ID/scan"       | jq '.vulnerabilities | map(select(.severity == "CRITICAL")) | length')
    
    if [ "$CRITICAL" -gt 0 ]; then
      echo "Found $CRITICAL critical vulnerabilities. Failing build."
      exit 1
    fi

Ignoring specific CVEs

Some CVEs may be acceptable for your use case (e.g., a CVE in a library you don't use the vulnerable code path of). Add them to your .fastpanel-trivy.yaml:

vulnerabilities:
  ignore:
    - CVE-2024-12345  # not exploitable, affected code path not reached