Skip to content

Mark Azure Functions/Cloud Run scanning and GAR GA, expand supported registries #39686

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
leo-wang-dd wants to merge 1 commit into
base: master
Choose a base branch
from
+18 −15
Open

Mark Azure Functions/Cloud Run scanning and GAR GA, expand supported registries #39686

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 16 additions & 13 deletions ...en/security/cloud_security_management/setup/agentless_scanning/compatibility.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,10 +17,10 @@ The following table provides a summary of Agentless Scanning technologies in rel
| Package Manager | Deb (debian, ubuntu) <br> RPM (amazon-linux, fedora, redhat, centos) <br> APK (alpine) | Deb (debian, ubuntu) <br> RPM (fedora, redhat, centos) <br> APK (alpine) | Deb (debian, ubuntu) <br> RPM (fedora, redhat, centos) <br> APK (alpine) |
| Encryption | AWS </br> Unencrypted </br> Encrypted - Platform Managed Key (PMK) and Customer Managed Key (CMK) | Encrypted - Platform Managed Key (PMK): Azure Disk Storage Server-Side Encryption, Encryption at host </br> **Note**: Encrypted - Customer Managed Key (CMK) is **not** supported | Encrypted - Platform Managed Key (PMK): Persistent Disk Encryption, Confidential VM </br> **Note**: Encrypted - Customer Managed Encryption Key (CMEK) and Customer-Supplied Encryption Keys (CSEK) are **not** supported |
| Container runtime | Docker, containerd </br> **Note**: CRI-O is **not** supported | Docker, containerd </br> **Note**: CRI-O is **not** supported | Docker, containerd </br> **Note**: CRI-O is **not** supported |
| Serverless | AWS Lambda <br> AWS Fargate for ECS | Azure Functions ([Preview][20]), Azure Container Apps, Azure Container Instances<br />**Note**: Requires the latest agentless scanner. See [Update Agentless Scanning][17]. | Cloud Run ([Preview][21]) |
| Serverless | AWS Lambda <br> AWS Fargate for ECS | Azure Functions, Azure Container Apps, Azure Container Instances<br />**Note**: Requires the latest agentless scanner. See [Update Agentless Scanning][17]. | Cloud Run |
| Kubernetes | EKS on EC2 nodes </br> EKS on Fargate </br> **Note**: EKS on Fargate requires the [Datadog Cluster Agent][18] to be installed | AKS on VMs, Virtual Machine Scale Sets (VMSS), and Azure Container Instances (ACI) </br> **Note**: AKS on ACI requires the [Datadog Cluster Agent][18] to be installed | GKE Standard and GKE Autopilot </br> **Note**: GKE Autopilot requires the [Datadog Cluster Agent][18] to be installed |
| Application languages (in hosts and containers) | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda |
| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only<br />**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads only<br />**Note**: Google Artifact Registry at-rest scanning support is in [Preview][19] |
| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only<br />**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads and images at rest<br />See [Container image registries](#container-image-registries) for the full list of supported registries |

@buraizu buraizu Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggesting to disambiguate the anchor link here so that it's clear it leads to a different section of the same page

Suggested change
| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only<br />**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads and images at rest<br />See [Container image registries](#container-image-registries) for the full list of supported registries |
| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only<br />**Note:** At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] | Google Artifact Registry: Scans images from running workloads and images at rest<br />See the [Container image registries](#container-image-registries) section for the full list of supported registries |

| Host Images | AMI | Not supported | Not supported |
| Sensitive Data (SDS) | S3 | Not supported | Not supported |

Expand Down Expand Up @@ -64,15 +64,21 @@ The following application languages and libraries are supported for vulnerabilit

## Container image registries

The following container image registries are supported for container image scans:
Registry scanning support depends on whether Datadog can enumerate images directly in the registry and scan them at rest, or whether it needs an authenticated pull to scan an image it has already found running in a workload or cached on a scanned node.

@buraizu buraizu Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggesting to split this into shorter sentences to make each mode easier to scan and register separately.

Suggested change
Registry scanning support depends on whether Datadog can enumerate images directly in the registry and scan them at rest, or whether it needs an authenticated pull to scan an image it has already found running in a workload or cached on a scanned node.
Registry scanning support depends on how Datadog accesses the registry. Some registries let Datadog enumerate and scan images directly at rest. Others require an authenticated pull to scan an image already running in a workload or cached on a scanned node.


| Registry | Support level | Notes |
|---------------------------------|---------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Amazon ECR (public and private) | GA | Scans running container images **and** the last 1,000 pushed images at rest (by date). This is the only registry with at-rest scanning support<br />**Note:** To increase the number of at-rest images to scan, contact [Datadog Support][16] |
| Google Artifact Registry (GAR) | Preview | Scans images tied to running workloads (Cloud Run, GKE) only<br />**Note**: Google Artifact Registry at-rest scanning support is in [Preview][19] |
| Azure Container Registry (ACR) | GA | Scans running container images from Azure Container Apps and Azure Container Instances only<br />**Note**: At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] |
| Registry | Scan type | Notes |
|----------------------------------------------------------------------------------|-----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Amazon ECR (public and private) | At rest and running | Scans running container images **and** the last 1,000 pushed images at rest (by date)<br />**Note**: To increase the number of at-rest images scanned, contact [Datadog Support][16] |
| Google Artifact Registry (GAR), including legacy Google Container Registry (`gcr.io`) hostnames | At rest and running | Scans images tied to running workloads (Cloud Run, GKE) and images at rest |

@buraizu buraizu Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The clause "including legacy Google Container Registry (gcr.io) hostnames" is hard to parse on first read since it isn't clear it means images pushed under those legacy hostnames rather than something else about the registry entry itself.

Suggested change
| Google Artifact Registry (GAR), including legacy Google Container Registry (`gcr.io`) hostnames | At rest and running | Scans images tied to running workloads (Cloud Run, GKE) and images at rest |
| Google Artifact Registry (GAR), including images pushed to legacy Google Container Registry (`gcr.io`) hostnames | At rest and running | Scans images tied to running workloads (Cloud Run, GKE) and images at rest |

| Azure Container Registry (ACR) | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node<br />**Note**: At-rest registry scanning is not supported. To request it, contact [Datadog Support][16] |
| Docker Hub | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node |
| GitHub Container Registry (GHCR) | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node |
| Microsoft Container Registry (MCR) | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node |
| Kubernetes registry (`registry.k8s.io`) | Authenticated pull | Images are scanned when running in a workload or cached on a scanned node |

**Note**: Container image scanning from registry is only supported if you have installed Agentless with:
**Note**: Self-hosted registries are not supported.

Container image scanning from registry is only supported if you have installed Agentless with:
- CloudFormation Integrations >= v2.0.8
- Terraform Agentless Module >= v0.11.7

Expand Down Expand Up @@ -102,7 +108,4 @@ The following container runtimes are supported:
[15]: https://ubuntu.com/security/cve
[16]: /help
[17]: /security/cloud_security_management/setup/agentless_scanning/update
[18]: /containers/cluster_agent/setup/
[19]: https://www.datadoghq.com/product-preview/google-artifact-registry-at-rest-scanning/
[20]: https://www.datadoghq.com/product-preview/azure-functions-vulnerability-scanning/
[21]: https://www.datadoghq.com/product-preview/google-cloud-run-functions-vulnerability-scanning/
[18]: /containers/cluster_agent/setup/
4 changes: 2 additions & 2 deletions hugo/content/en/security/cloud_security_management/vulnerabilities/_index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ Use these tables to decide which solution to start with:
| Cloud provider | AWS, Azure, GCP | AWS, Azure, GCP, on-prem, etc. |
| Operating system | Linux, Windows | Linux, Windows |
| Serverless | AWS Lambda, Amazon ECS Fargate, Azure Container Apps, Azure Container Instances, GCP Cloud Run (container deployment only) | Not applicable |
| Container registries | Amazon ECR (running + at-rest), Google Artifact Registry (running workloads only; in [Preview][8]), Azure Container Registry (running container images only) | Not applicable |
| Container registries | Amazon ECR and Google Artifact Registry (running + at-rest); Azure Container Registry, Docker Hub, GitHub Container Registry, Microsoft Container Registry, and Kubernetes registry (authenticated pull only). See [Container image registries][24] for details | Not applicable |

For more information on compatibility, see [Cloud Security Vulnerabilities Hosts and Containers Compatibility][13]. If you need any assistance, see the [troubleshooting guide][14], or reach out to support@datadoghq.com.

Expand Down Expand Up @@ -145,7 +145,6 @@ Quickly assess the impact of a critical emerging vulnerability by searching for
[5]: /security/code_security/software_composition_analysis/
[6]: https://www.datadoghq.com/product/infrastructure-monitoring/
[7]: https://app.datadoghq.com/container-images
[8]: https://www.datadoghq.com/product-preview/google-artifact-registry-at-rest-scanning/
[9]: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
[10]: /security/code_security/iast/
[11]: /security/cloud_security_management/setup/agentless_scanning/
Expand All @@ -160,6 +159,7 @@ Quickly assess the impact of a critical emerging vulnerability by searching for
[21]: /security/cloud_security_management/setup/ci_cd
[22]: /security/cloud_security_management/setup/ci_cd/#link-dockerfile-to-vulnerabilities
[23]: https://app.datadoghq.com/security/csm/vm?query=-%40risk.is_image_running%3Afalse%20%40status%3Aopen%20%40risk.has_exploit_available%3Atrue%20%40remediation.is_available%3Atrue%20%40severity%3A%28high%20OR%20critical%29%20%40vulnerability.is_inherited_from_base_image%3Atrue&group=none&order=desc&sort=score
[24]: /security/cloud_security_management/setup/agentless_scanning/compatibility/#container-image-registries

## Further reading

Expand Down
Loading