Docker / OCI

Review Docker and OCI container image scanning support in JFrog Xray.

Introduction

JFrog Xray provides security and compliance analysis for Docker and Open Container Initiative (OCI) container images throughout the software development lifecycle.
This page describes the supported scan contexts, capabilities, and analysis available for containers, split by scanning context.

Capabilities

The following table summarizes the binary scanning capabilities available for Docker and OCI container images.

Capability	Binary Scanning
Vulnerability Matching for CVEs
License Detection
Malicious Package Detection
Base Image Detection
Smart Remediation for base image upgrade

When a CVE comes from the base image your container is built on, Xray can recommend a newer version of that base image and give you the FROM line to put in your Dockerfile. For more information, see Smart Remediation.

Prerequisites for Base Image Upgrades

JFrog Advanced Security, which the Remediation tab in scan results requires.
Base Image Detection, so Xray must have scanned both your image and its base image.
In self-managed environments, SBOM and dependencies must be enabled (sbom.enabled: true, sbom.dependenciesEnabled: true).

Binary Scanning

Binary scanning analyzes container images stored in JFrog Artifactory Docker and OCI repositories. Xray unpacks image layers and scans all OS packages and application dependencies found within the image.

Supported Package Formats

The following package formats are supported for Docker and OCI container images.

Container Format	Supported
Docker
OCI
Chainguard Images

What Gets Scanned Inside Containers

When scanning a Docker or OCI container image, Xray identifies and analyzes the following.

OS packages: Debian dpkg, RPM, and Alpine apk.
Application dependencies: npm, PyPI, Maven, Go, NuGet, and other package ecosystems.
ML models: HuggingFace ML and generic model formats.
Nested archives: Scans archives within image layers.

Additional Information

Container image scanning is binary-only. Images must be pushed to Artifactory to be scanned.
Xray recursively unpacks image layers and scans all embedded packages.
Both Docker and OCI image formats are fully supported.
Multi-architecture images are supported.
For contextual analysis packaging requirements by language, see Package Applications in Docker for Contextual Analysis.