From d0d4d6219c0ec4901f3804cca8a89c3543e7af06 Mon Sep 17 00:00:00 2001 From: Leo Wang Date: Wed, 2 Sep 2026 16:33:21 -0400 Subject: [PATCH] Mark Azure Functions/Cloud Run serverless and GAR scanning GA, expand supported registries Azure Functions and Cloud Run agentless scanning, plus Google Artifact Registry running-workload and at-rest scanning, are now GA. Removed Preview labels and links across the Agentless Scanning Compatibility and Cloud Security Vulnerabilities pages. Also expanded the container image registries list to include Docker Hub, GitHub Container Registry, Microsoft Container Registry, and the Kubernetes registry, clarifying which registries support at-rest scanning versus authenticated-pull-only scanning, and noting that self-hosted registries aren't supported. --- .../setup/agentless_scanning/compatibility.md | 29 ++++++++++--------- .../vulnerabilities/_index.md | 4 +-- 2 files changed, 18 insertions(+), 15 deletions(-) diff --git a/hugo/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md b/hugo/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md index 82c9dabed88..eaaaf4a6f98 100644 --- a/hugo/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md +++ b/hugo/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md @@ -17,10 +17,10 @@ The following table provides a summary of Agentless Scanning technologies in rel | Package Manager | Deb (debian, ubuntu)
RPM (amazon-linux, fedora, redhat, centos)
APK (alpine) | Deb (debian, ubuntu)
RPM (fedora, redhat, centos)
APK (alpine) | Deb (debian, ubuntu)
RPM (fedora, redhat, centos)
APK (alpine) | | Encryption | AWS
Unencrypted
Encrypted - Platform Managed Key (PMK) and Customer Managed Key (CMK) | Encrypted - Platform Managed Key (PMK): Azure Disk Storage Server-Side Encryption, Encryption at host
**Note**: Encrypted - Customer Managed Key (CMK) is **not** supported | Encrypted - Platform Managed Key (PMK): Persistent Disk Encryption, Confidential VM
**Note**: Encrypted - Customer Managed Encryption Key (CMEK) and Customer-Supplied Encryption Keys (CSEK) are **not** supported | | Container runtime | Docker, containerd
**Note**: CRI-O is **not** supported | Docker, containerd
**Note**: CRI-O is **not** supported | Docker, containerd
**Note**: CRI-O is **not** supported | -| Serverless | AWS Lambda
AWS Fargate for ECS | Azure Functions ([Preview][20]), Azure Container Apps, Azure Container Instances
**Note**: Requires the latest agentless scanner. See [Update Agentless Scanning][17]. | Cloud Run ([Preview][21]) | +| Serverless | AWS Lambda
AWS Fargate for ECS | Azure Functions, Azure Container Apps, Azure Container Instances
**Note**: Requires the latest agentless scanner. See [Update Agentless Scanning][17]. | Cloud Run | | Kubernetes | EKS on EC2 nodes
EKS on Fargate
**Note**: EKS on Fargate requires the [Datadog Cluster Agent][18] to be installed | AKS on VMs, Virtual Machine Scale Sets (VMSS), and Azure Container Instances (ACI)
**Note**: AKS on ACI requires the [Datadog Cluster Agent][18] to be installed | GKE Standard and GKE Autopilot
**Note**: GKE Autopilot requires the [Datadog Cluster Agent][18] to be installed | | Application languages (in hosts and containers) | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | -| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only
**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads only
**Note**: Google Artifact Registry at-rest scanning support is in [Preview][19] | +| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only
**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads and images at rest
See [Container image registries](#container-image-registries) for the full list of supported registries | | Host Images | AMI | Not supported | Not supported | | Sensitive Data (SDS) | S3 | Not supported | Not supported | @@ -64,15 +64,21 @@ The following application languages and libraries are supported for vulnerabilit ## Container image registries -The following container image registries are supported for container image scans: +Registry scanning support depends on whether Datadog can enumerate images directly in the registry and scan them at rest, or whether it needs an authenticated pull to scan an image it has already found running in a workload or cached on a scanned node. -| Registry | Support level | Notes | -|---------------------------------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Amazon ECR (public and private) | GA | Scans running container images **and** the last 1,000 pushed images at rest (by date). This is the only registry with at-rest scanning support
**Note:** To increase the number of at-rest images to scan, contact [Datadog Support][16] | -| Google Artifact Registry (GAR) | Preview | Scans images tied to running workloads (Cloud Run, GKE) only
**Note**: Google Artifact Registry at-rest scanning support is in [Preview][19] | -| Azure Container Registry (ACR) | GA | Scans running container images from Azure Container Apps and Azure Container Instances only
**Note**: At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | +| Registry | Scan type | Notes | +|----------------------------------------------------------------------------------|-----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------| +| Amazon ECR (public and private) | At rest and running | Scans running container images **and** the last 1,000 pushed images at rest (by date)
**Note**: To increase the number of at-rest images scanned, contact [Datadog Support][16] | +| Google Artifact Registry (GAR), including legacy Google Container Registry (`gcr.io`) hostnames | At rest and running | Scans images tied to running workloads (Cloud Run, GKE) and images at rest | +| Azure Container Registry (ACR) | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node
**Note**: At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | +| Docker Hub | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node | +| GitHub Container Registry (GHCR) | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node | +| Microsoft Container Registry (MCR) | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node | +| Kubernetes registry (`registry.k8s.io`) | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node | -**Note**: Container image scanning from registry is only supported if you have installed Agentless with: +**Note**: Self-hosted registries are not supported. + +Container image scanning from registry is only supported if you have installed Agentless with: - CloudFormation Integrations >= v2.0.8 - Terraform Agentless Module >= v0.11.7 @@ -102,7 +108,4 @@ The following container runtimes are supported: [15]: https://ubuntu.com/security/cve [16]: /help [17]: /security/cloud_security_management/setup/agentless_scanning/update -[18]: /containers/cluster_agent/setup/ -[19]: https://www.datadoghq.com/product-preview/google-artifact-registry-at-rest-scanning/ -[20]: https://www.datadoghq.com/product-preview/azure-functions-vulnerability-scanning/ -[21]: https://www.datadoghq.com/product-preview/google-cloud-run-functions-vulnerability-scanning/ \ No newline at end of file +[18]: /containers/cluster_agent/setup/ \ No newline at end of file diff --git a/hugo/content/en/security/cloud_security_management/vulnerabilities/_index.md b/hugo/content/en/security/cloud_security_management/vulnerabilities/_index.md index f513cc93fad..f8280b3d823 100644 --- a/hugo/content/en/security/cloud_security_management/vulnerabilities/_index.md +++ b/hugo/content/en/security/cloud_security_management/vulnerabilities/_index.md @@ -88,7 +88,7 @@ Use these tables to decide which solution to start with: | Cloud provider | AWS, Azure, GCP | AWS, Azure, GCP, on-prem, etc. | | Operating system | Linux, Windows | Linux, Windows | | Serverless | AWS Lambda, Amazon ECS Fargate, Azure Container Apps, Azure Container Instances, GCP Cloud Run (container deployment only) | Not applicable | -| Container registries | Amazon ECR (running + at-rest), Google Artifact Registry (running workloads only; in [Preview][8]), Azure Container Registry (running container images only) | Not applicable | +| Container registries | Amazon ECR and Google Artifact Registry (running + at-rest); Azure Container Registry, Docker Hub, GitHub Container Registry, Microsoft Container Registry, and Kubernetes registry (authenticated pull only). See [Container image registries][24] for details | Not applicable | For more information on compatibility, see [Cloud Security Vulnerabilities Hosts and Containers Compatibility][13]. If you need any assistance, see the [troubleshooting guide][14], or reach out to support@datadoghq.com. @@ -145,7 +145,6 @@ Quickly assess the impact of a critical emerging vulnerability by searching for [5]: /security/code_security/software_composition_analysis/ [6]: https://www.datadoghq.com/product/infrastructure-monitoring/ [7]: https://app.datadoghq.com/container-images -[8]: https://www.datadoghq.com/product-preview/google-artifact-registry-at-rest-scanning/ [9]: https://www.cisa.gov/known-exploited-vulnerabilities-catalog [10]: /security/code_security/iast/ [11]: /security/cloud_security_management/setup/agentless_scanning/ @@ -160,6 +159,7 @@ Quickly assess the impact of a critical emerging vulnerability by searching for [21]: /security/cloud_security_management/setup/ci_cd [22]: /security/cloud_security_management/setup/ci_cd/#link-dockerfile-to-vulnerabilities [23]: https://app.datadoghq.com/security/csm/vm?query=-%40risk.is_image_running%3Afalse%20%40status%3Aopen%20%40risk.has_exploit_available%3Atrue%20%40remediation.is_available%3Atrue%20%40severity%3A%28high%20OR%20critical%29%20%40vulnerability.is_inherited_from_base_image%3Atrue&group=none&order=desc&sort=score +[24]: /security/cloud_security_management/setup/agentless_scanning/compatibility/#container-image-registries ## Further reading