instruction: How do you implement comprehensive container security scanning?
output: Harbor docs | Vulnerability Scanning 2.5.0 Home Getting Started Community Blog Docs 2.13.0 &nbsp;&nbsp; latest 2.12.0 &nbsp;&nbsp; 2.11.0 &nbsp;&nbsp; 2.10.0 &nbsp;&nbsp; 2.9.0 &nbsp;&nbsp; 2.8.0 &nbsp;&nbsp; 2.7.0 &nbsp;&nbsp; 2.6.0 &nbsp;&nbsp; 2.5.0 &nbsp;&nbsp; 2.4.0 &nbsp;&nbsp; 2.3.0 &nbsp;&nbsp; 2.2.0 &nbsp;&nbsp; 2.1.0 &nbsp;&nbsp; 2.0.0 &nbsp;&nbsp; 1.10 &nbsp;&nbsp; Vulnerability Scanning Harbor version 2.5.0 Harbor Installation and Configuration Harbor Administration Configuring Authentication Managing Users Configure Global Settings Configure Project Quotas User-defined OCI artifact Configuring Replication P2P Preheat Configure Proxy Cache Vulnerability Scanning Connect Harbor to Additional Vulnerability Scanners Scan Individual Artifacts Stop Scan &amp; Stop Scan All Deployment security Scan All Artifacts Schedule Scans Import Vulnerability Data to an Offline Harbor instance Configure System-Wide CVE Allowlists Configure custom Certification Authorities for trivy Access Metrics Distributed Tracing Create System Robot Accounts Garbage Collection Upgrade Harbor and Migrate Data Working with Projects Building, Customizing, and Contributing to Harbor Harbor provides static analysis of vulnerabilities in images through the open source projects Trivy . To be able to use Trivy you must have enabled Trivy when you installed your Harbor instance (by appending installation options --with-trivy ). For information about installing Harbor with Trivy, see the Run the Installer Script . If the upgrading path is from the version that is &gt;=V1.10 to current version (V2.0) and there was an existing system default scanner “ABC” is set in the previous version, that scanner &ldquo;ABC&rdquo; will be kept as system default scanner; You can also connect Harbor to your own instance of Trivy or to other additional vulnerability scanners through Harbor&rsquo;s embedded interrogation service. These scanners can be configured in the Harbor UI at any time after installation. It might be necessary to connect Harbor to other scanners for corporate compliance reasons, or because your organization already uses a particular scanner. Different scanners also use different vulnerability databases, capture different CVE sets, and apply different severity thresholds. By connecting Harbor to more than one vulnerability scanner, you broaden the scope of your protection against vulnerabilities. For the list of additional scanners that are currently supported, see the Harbor Compatibility List . Clair has been removed as a default scanner in v2.2. You are still able to use Clair for vulnerability scanning by adding it as an external scanner. You can manually initiate scanning on a particular image, or on all images in Harbor. Additionally, you can also set a policy to automatically scan all of the images at specific intervals. Vulnerability scans of Cosign signatures are not supported. You can also export scans for an image using the Harbor API endpoint /projects/{project_name}/repositories/{repository_name}/artifacts/{reference}/additions/vulnerabilities . See more information about using this endpoint in the Harbor Swagger file . Pages in this section Connect Harbor to Additional Vulnerability Scanners Scan Individual Artifacts Stop Scan &amp; Stop Scan All Deployment security Scan All Artifacts Schedule Scans Import Vulnerability Data to an Offline Harbor instance Configure System-Wide CVE Allowlists Configure custom Certification Authorities for trivy Contributing Page source Create issue GitHub Community Registry Status Logos Slack Twitter &copy; Harbor Authors 2025 | Documentation Distributed under CC-BY-4.0 &copy; 2025 The Linux Foundation . All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page.