Harbor-as-a-Service에서 생성된 모든 Harbor 인스턴스는 Trivy 취약점 스캐너에 연결되어 컨테이너 이미지의 보안 위험을 식별하고 해결하는 데 도움이 됩니다. Trivy는 Harbor 버전 2.2 이상의 기본 스캐너입니다.
Trivy는 컨테이너 이미지의 콘텐츠를 분석하고 이를 National Vulnerability Database와 같은 알려진 취약점 데이터베이스와 비교하여 잠재적인 문제를 식별합니다.자세한 내용은 https://github.com/aquasecurity/trivy를 참고하세요.
취약점 스캔을 Harbor 워크플로에 통합하여 컨테이너화된 애플리케이션의 보안을 사전 대응적으로 관리하고 잠재적인 위협으로부터 조직을 보호하세요. 취약점이 있는 이미지를 실행할 수 없도록 프로젝트를 구성하고 이미지가 프로젝트로 푸시되는 즉시 이미지를 자동으로 스캔합니다.
Harbor 프로젝트의 취약점 설정을 구성하려면 다음 단계를 따르세요.
ProjectAdmin 역할이 있는 계정으로 Harbor 인터페이스에 로그인합니다.
프로젝트로 이동하여 프로젝트를 선택합니다.
구성 탭을 클릭합니다.
프로젝트의 취약한 이미지가 풀되지 않도록 하려면 취약한 이미지 실행 방지 체크박스를 사용 설정합니다.
이미지가 실행되지 않도록 취약점의 심각도 수준을 선택합니다.
프로젝트에 푸시된 새 이미지에 대한 즉각적인 취약점 스캔을 활성화하려면 푸시 시 이미지 자동 스캔 체크박스를 선택합니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[[["\u003cp\u003eHarbor instances use the Trivy vulnerability scanner to identify security risks in container images by comparing them against known vulnerability databases.\u003c/p\u003e\n"],["\u003cp\u003eTo perform vulnerability scans, you must have Trivy enabled during Harbor installation and possess an account with the \u003ccode\u003eProjectAdmin\u003c/code\u003e role within an existing Harbor project.\u003c/p\u003e\n"],["\u003cp\u003eYou can scan individual artifacts by selecting a project, going to the repositories tab, and clicking scan, or view the scan status and detail in the Vulnerabilities column.\u003c/p\u003e\n"],["\u003cp\u003eYou can scan all artifacts in your Harbor instance by accessing the Interrogation Services within the Administration menu, and clicking "Scan now" in the vulnerability tab.\u003c/p\u003e\n"],["\u003cp\u003eHarbor projects can be configured to prevent vulnerable images from running based on severity level and automatically scan newly pushed images.\u003c/p\u003e\n"]]],[],null,["# Scan for vulnerabilities\n\nEvery Harbor instance created in Harbor-as-a-Service connects to a Trivy\nvulnerability scanner to help you identify and address security risks in your\ncontainer images. Trivy is the default scanner in Harbor versions 2.2 and later.\nTrivy analyzes the contents of your container images, comparing them against\nknown vulnerability databases, like the National Vulnerability Database, to\nidentify potential issues.For more information, see\n\u003chttps://github.com/aquasecurity/trivy\u003e.\n\nBefore you begin\n----------------\n\nYou must have the following to scan for vulnerabilities:\n\n- Trivy. You must have enabled Trivy when you installed your Harbor instance by appending installation options `--with-trivy`. For information about installing Harbor with Trivy, see \u003chttps://goharbor.io/docs/2.8.0/install-config/run-installer-script/\u003e.\n- An account with the `ProjectAdmin` role from Harbor's role-based access controls. For more information, see [Configure access for APIs and within a Harbor instance](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/configure-access-control#configure-access-within-harbor-instance).\n- An existing Harbor project. For more information, see [Create Harbor projects](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/create-harbor-projects).\n\nYou can scan individual artifacts in Harbor, or configure vulnerability\nsettings in Harbor projects.\n\nScan individual artifacts in Harbor\n-----------------------------------\n\nFollow these steps to scan individual artifacts in Harbor:\n\n1. Sign in to the Harbor interface with an account that has the `ProjectAdmin` role.\n2. Go to **Projects** and select a project.\n3. Click the **Scanner** tab. The **Scanner** tab shows the current scanner in use for this project.\n4. Click **Edit** to select a different scanner from the list of scanners that are connected to this Harbor instance, and click **OK**.\n5. Click the **Repositories** tab and select a repository.\n6. For each artifact in the repository, the **Vulnerabilities** column displays the vulnerability scanning status and related information.\n7. Select an artifact, or use the checkbox at the top to select all\n artifacts in the repository, and click **Scan** to run the\n vulnerability scan on this artifact.\n\n | **Note:** You can start a scan at any time, unless the status is Queued or Scanning.\n8. Hold the pointer over the number of fixable vulnerabilities to see a summary of\n the vulnerability report.\n\n9. Click the artifact digest to see a detailed vulnerability report.\n\nFor more information, see the Harbor documentation:\n\u003chttps://goharbor.io/docs/2.8.0/administration/vulnerability-scanning/scan-individual-artifact/\u003e.\n\nScan all artifacts in Harbor\n----------------------------\n\nFollow these steps to scan all of the artifacts in your Harbor instance:\n\n1. Sign in to the Harbor interface with an account that has the `ProjectAdmin` role.\n2. In the **Administration** menu, click **Interrogation Services**.\n3. To perform a scan of all artifacts in your Harbor instance, select the **Vulnerability** tab and click **Scan now**.\n\n | **Note:** **Scan now** becomes unavailable while the scan is in progress.\n\nFor more information, see the Harbor documentation:\n\u003chttps://goharbor.io/docs/2.8.0/administration/vulnerability-scanning/scan-all-artifacts/\u003e.\n\nConfigure vulnerability settings in Harbor projects\n---------------------------------------------------\n\nIntegrate vulnerability scanning into your Harbor workflow to proactively manage\nthe security of your containerized applications and protect your organization\nfrom potential threats. Configure projects so that images with vulnerabilities\ncannot be run, and to automatically scan images as soon as they are pushed into\nthe project.\n\nFollow these steps to configure vulnerability settings for a Harbor project:\n\n1. Sign in to the Harbor interface with an account that has the `ProjectAdmin` role.\n2. Go to **Projects** and select a project.\n3. Click the **Configuration** tab.\n4. To prevent vulnerable images under the project from being pulled, enable the **Prevent vulnerable images from running** checkbox.\n5. Select the severity level of vulnerabilities to prevent images from running.\n\n | **Note:** Images cannot be pulled if their level is equal to or higher than the selected level of severity. Harbor does not prevent images with a vulnerability severity of negligible from running.\n6. To activate an immediate vulnerability scan on new images that are\n pushed to the project, select the **Automatically scan images on push**\n checkbox.\n\nFor more information, see the Harbor documentation:\n\u003chttps://goharbor.io/docs/2.8.0/working-with-projects/project-configuration/\u003e."]]
