Docker / OCI
Introduction
JFrog Xray provides security and compliance analysis for Docker and OCI container images throughout the software development lifecycle.
This page describes the supported scan contexts, capabilities, and analysis available for containers, split by scanning context.
Capabilities
The following table summarizes the binary scanning capabilities available for container images.
| Capability | Binary Scanning |
|---|---|
| Vulnerability Matching (CVEs) | ✅ |
| License Detection | ✅ |
| Malicious Package Detection | ✅ |
| Base Image Detection | ✅ |
| Smart Remediation (base image upgrade) | ✅ |
When a CVE comes from the base image your container is built on, Xray can recommend a newer version of that base image and give you the FROM line to put in your Dockerfile. For more information, see Smart Remediation.
Prerequisites for base image upgrades
- JFrog Advanced Security, which the Remediation tab in scan results requires.
- Base Image Detection, so Xray must have scanned both your image and its base image.
- In self-managed environments, enable SBOM and dependencies (
sbom.enabled: true,sbom.dependenciesEnabled: true).
Binary Scanning
Binary scanning analyzes container images stored in Artifactory Docker/OCI repositories. Xray unpacks image layers and scans all OS packages and application dependencies found within the image.
Supported Package Formats
| Container Format | Supported |
|---|---|
| Docker | ✅ |
| OCI | ✅ |
| Chainguard Images | ✅ |
What Gets Scanned Inside Containers
When scanning a container image, Xray identifies and analyzes:
- OS packages: Debian (dpkg), RPM, Alpine (apk)
- Application dependencies: npm, PyPI, Maven, Go, NuGet, etc.
- ML Models: HuggingFace ML and generic model formats
- Nested archives: Scans archives within image layers
Additional Information
- Container image scanning is binary-only – images must be pushed to Artifactory to be scanned
- Xray recursively unpacks image layers and scans all embedded packages
- Both Docker and OCI image formats are fully supported
- Multi-architecture images are supported
- For contextual analysis packaging requirements by language, see Package Applications in Docker for Contextual Analysis.
Updated 16 days ago