Mark Azure Functions/Cloud Run scanning and GAR GA, expand supported registries - #39686
Open
leo-wang-dd wants to merge 1 commit into
Open
Mark Azure Functions/Cloud Run scanning and GAR GA, expand supported registries#39686leo-wang-dd wants to merge 1 commit into
leo-wang-dd wants to merge 1 commit into
Conversation
… supported registries Azure Functions and Cloud Run agentless scanning, plus Google Artifact Registry running-workload and at-rest scanning, are now GA. Removed Preview labels and links across the Agentless Scanning Compatibility and Cloud Security Vulnerabilities pages. Also expanded the container image registries list to include Docker Hub, GitHub Container Registry, Microsoft Container Registry, and the Kubernetes registry, clarifying which registries support at-rest scanning versus authenticated-pull-only scanning, and noting that self-hosted registries aren't supported.
Contributor
Preview links (active after the
|
buraizu
reviewed
Sep 2, 2026
buraizu
left a comment
buraizu
left a comment
Collaborator
There was a problem hiding this comment.
Thanks for the PR! Looks good overall, but requested a few small updates
| | Kubernetes | EKS on EC2 nodes </br> EKS on Fargate </br> **Note**: EKS on Fargate requires the [Datadog Cluster Agent][18] to be installed | AKS on VMs, Virtual Machine Scale Sets (VMSS), and Azure Container Instances (ACI) </br> **Note**: AKS on ACI requires the [Datadog Cluster Agent][18] to be installed | GKE Standard and GKE Autopilot </br> **Note**: GKE Autopilot requires the [Datadog Cluster Agent][18] to be installed | | ||
| | Application languages (in hosts and containers) | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | | ||
| | Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only<br />**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads only<br />**Note**: Google Artifact Registry at-rest scanning support is in [Preview][19] | | ||
| | Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only<br />**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads and images at rest<br />See [Container image registries](#container-image-registries) for the full list of supported registries | |
Collaborator
There was a problem hiding this comment.
Suggesting to disambiguate the anchor link here so that it's clear it leads to a different section of the same page
Suggested change
| | Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only<br />**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads and images at rest<br />See [Container image registries](#container-image-registries) for the full list of supported registries | | |
| | Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only<br />**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads and images at rest<br />See the [Container image registries](#container-image-registries) section for the full list of supported registries | |
| ## Container image registries | ||
|
|
||
| The following container image registries are supported for container image scans: | ||
| Registry scanning support depends on whether Datadog can enumerate images directly in the registry and scan them at rest, or whether it needs an authenticated pull to scan an image it has already found running in a workload or cached on a scanned node. |
Collaborator
There was a problem hiding this comment.
Suggesting to split this into shorter sentences to make each mode easier to scan and register separately.
Suggested change
| Registry scanning support depends on whether Datadog can enumerate images directly in the registry and scan them at rest, or whether it needs an authenticated pull to scan an image it has already found running in a workload or cached on a scanned node. | |
| Registry scanning support depends on how Datadog accesses the registry. Some registries let Datadog enumerate and scan images directly at rest. Others require an authenticated pull to scan an image already running in a workload or cached on a scanned node. |
| | Registry | Scan type | Notes | | ||
| |----------------------------------------------------------------------------------|-----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| | ||
| | Amazon ECR (public and private) | At rest and running | Scans running container images **and** the last 1,000 pushed images at rest (by date)<br />**Note**: To increase the number of at-rest images scanned, contact [Datadog Support][16] | | ||
| | Google Artifact Registry (GAR), including legacy Google Container Registry (`gcr.io`) hostnames | At rest and running | Scans images tied to running workloads (Cloud Run, GKE) and images at rest | |
Collaborator
There was a problem hiding this comment.
The clause "including legacy Google Container Registry (gcr.io) hostnames" is hard to parse on first read since it isn't clear it means images pushed under those legacy hostnames rather than something else about the registry entry itself.
Suggested change
| | Google Artifact Registry (GAR), including legacy Google Container Registry (`gcr.io`) hostnames | At rest and running | Scans images tied to running workloads (Cloud Run, GKE) and images at rest | | |
| | Google Artifact Registry (GAR), including images pushed to legacy Google Container Registry (`gcr.io`) hostnames | At rest and running | Scans images tied to running workloads (Cloud Run, GKE) and images at rest | |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do? What is the motivation?
Azure Functions and Cloud Run agentless scanning, and Google Artifact Registry (running-workload and at-rest) scanning, are now GA. This PR removes the remaining Preview labels and product-preview links for these features from the Agentless Scanning Compatibility and Cloud Security Vulnerabilities pages.
It also expands the supported container image registries list to include Docker Hub, GitHub Container Registry, Microsoft Container Registry, and the Kubernetes registry, clarifying which registries support at-rest scanning versus authenticated-pull-only scanning, and notes that self-hosted registries aren't supported.
Merge readiness
For Datadog employees:
<name>/<description>convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR./reviewto run an automated check that catches common issues before a Documentation team member reviews your PR.AI assistance
Used Claude Code to identify and update all Preview mentions for these features, and to draft the expanded registry compatibility table.
Additional notes