Mantenha tudo organizado com as coleções
Salve e categorize o conteúdo com base nas suas preferências.
Cada instância do Harbor criada no Harbor como serviço se conecta a um verificador de vulnerabilidades do Trivy para ajudar você a identificar e resolver riscos de segurança nas imagens de contêiner. O Trivy é o scanner padrão nas versões 2.2 e mais recentes do Harbor.
O Trivy analisa o conteúdo das imagens de contêiner, comparando-as com bancos de dados de vulnerabilidades conhecidas, como o National Vulnerability Database, para identificar possíveis problemas.Para mais informações, consulte https://github.com/aquasecurity/trivy.
Antes de começar
Para verificar vulnerabilidades, você precisa ter o seguinte:
É possível verificar artefatos individuais no Harbor ou configurar as definições de vulnerabilidade em projetos do Harbor.
Verificar artefatos individuais no Harbor
Siga estas etapas para verificar artefatos individuais no Harbor:
Faça login na interface do Harbor com uma conta que tenha a função ProjectAdmin.
Acesse Projetos e selecione um projeto.
Clique na guia Scanner. A guia Scanner mostra o scanner atual
em uso para este projeto.
Clique em Editar para selecionar outro scanner na lista de scanners
conectados a esta instância do Harbor e clique em OK.
Clique na guia Repositórios e selecione um repositório.
Para cada artefato no repositório, a coluna Vulnerabilidades mostra o status da verificação de vulnerabilidades e informações relacionadas.
Selecione um artefato ou use a caixa de seleção na parte de cima para selecionar todos os artefatos no repositório e clique em Verificar para executar a verificação de vulnerabilidade nesse artefato.
Mantenha o ponteiro sobre o número de vulnerabilidades corrigíveis para ver um resumo do relatório de vulnerabilidades.
Clique no resumo do artefato para ver um relatório detalhado de vulnerabilidades.
Configurar as configurações de vulnerabilidade em projetos do Harbor
Integre a verificação de vulnerabilidades ao seu fluxo de trabalho do Harbor para gerenciar de forma proativa a segurança dos seus aplicativos contêinerizados e proteger sua organização contra possíveis ameaças. Configure os projetos para que imagens com vulnerabilidades
não possam ser executadas e para verificar automaticamente as imagens assim que forem enviadas para
o projeto.
Siga estas etapas para configurar as opções de vulnerabilidade de um projeto do Harbor:
Faça login na interface do Harbor com uma conta que tenha a função ProjectAdmin.
Acesse Projetos e selecione um projeto.
Clique na guia Configuração.
Para impedir que imagens vulneráveis no projeto sejam extraídas, marque a caixa de seleção Impedir a execução de imagens vulneráveis.
Selecione o nível de gravidade das vulnerabilidades para impedir a execução das imagens.
Para ativar uma verificação imediata de vulnerabilidades em novas imagens enviadas ao projeto, marque a caixa de seleção Verificar automaticamente as imagens no envio.
[[["Fácil de entender","easyToUnderstand","thumb-up"],["Meu problema foi resolvido","solvedMyProblem","thumb-up"],["Outro","otherUp","thumb-up"]],[["Difícil de entender","hardToUnderstand","thumb-down"],["Informações incorretas ou exemplo de código","incorrectInformationOrSampleCode","thumb-down"],["Não contém as informações/amostras de que eu preciso","missingTheInformationSamplesINeed","thumb-down"],["Problema na tradução","translationIssue","thumb-down"],["Outro","otherDown","thumb-down"]],["Última atualização 2025-09-04 UTC."],[[["\u003cp\u003eHarbor instances use the Trivy vulnerability scanner to identify security risks in container images by comparing them against known vulnerability databases.\u003c/p\u003e\n"],["\u003cp\u003eTo perform vulnerability scans, you must have Trivy enabled during Harbor installation and possess an account with the \u003ccode\u003eProjectAdmin\u003c/code\u003e role within an existing Harbor project.\u003c/p\u003e\n"],["\u003cp\u003eYou can scan individual artifacts by selecting a project, going to the repositories tab, and clicking scan, or view the scan status and detail in the Vulnerabilities column.\u003c/p\u003e\n"],["\u003cp\u003eYou can scan all artifacts in your Harbor instance by accessing the Interrogation Services within the Administration menu, and clicking "Scan now" in the vulnerability tab.\u003c/p\u003e\n"],["\u003cp\u003eHarbor projects can be configured to prevent vulnerable images from running based on severity level and automatically scan newly pushed images.\u003c/p\u003e\n"]]],[],null,["# Scan for vulnerabilities\n\nEvery Harbor instance created in Harbor-as-a-Service connects to a Trivy\nvulnerability scanner to help you identify and address security risks in your\ncontainer images. Trivy is the default scanner in Harbor versions 2.2 and later.\nTrivy analyzes the contents of your container images, comparing them against\nknown vulnerability databases, like the National Vulnerability Database, to\nidentify potential issues.For more information, see\n\u003chttps://github.com/aquasecurity/trivy\u003e.\n\nBefore you begin\n----------------\n\nYou must have the following to scan for vulnerabilities:\n\n- Trivy. You must have enabled Trivy when you installed your Harbor instance by appending installation options `--with-trivy`. For information about installing Harbor with Trivy, see \u003chttps://goharbor.io/docs/2.8.0/install-config/run-installer-script/\u003e.\n- An account with the `ProjectAdmin` role from Harbor's role-based access controls. For more information, see [Configure access for APIs and within a Harbor instance](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/configure-access-control#configure-access-within-harbor-instance).\n- An existing Harbor project. For more information, see [Create Harbor projects](/distributed-cloud/hosted/docs/latest/gdch/platform-application/pa-ao-operations/create-harbor-projects).\n\nYou can scan individual artifacts in Harbor, or configure vulnerability\nsettings in Harbor projects.\n\nScan individual artifacts in Harbor\n-----------------------------------\n\nFollow these steps to scan individual artifacts in Harbor:\n\n1. Sign in to the Harbor interface with an account that has the `ProjectAdmin` role.\n2. Go to **Projects** and select a project.\n3. Click the **Scanner** tab. The **Scanner** tab shows the current scanner in use for this project.\n4. Click **Edit** to select a different scanner from the list of scanners that are connected to this Harbor instance, and click **OK**.\n5. Click the **Repositories** tab and select a repository.\n6. For each artifact in the repository, the **Vulnerabilities** column displays the vulnerability scanning status and related information.\n7. Select an artifact, or use the checkbox at the top to select all\n artifacts in the repository, and click **Scan** to run the\n vulnerability scan on this artifact.\n\n | **Note:** You can start a scan at any time, unless the status is Queued or Scanning.\n8. Hold the pointer over the number of fixable vulnerabilities to see a summary of\n the vulnerability report.\n\n9. Click the artifact digest to see a detailed vulnerability report.\n\nFor more information, see the Harbor documentation:\n\u003chttps://goharbor.io/docs/2.8.0/administration/vulnerability-scanning/scan-individual-artifact/\u003e.\n\nScan all artifacts in Harbor\n----------------------------\n\nFollow these steps to scan all of the artifacts in your Harbor instance:\n\n1. Sign in to the Harbor interface with an account that has the `ProjectAdmin` role.\n2. In the **Administration** menu, click **Interrogation Services**.\n3. To perform a scan of all artifacts in your Harbor instance, select the **Vulnerability** tab and click **Scan now**.\n\n | **Note:** **Scan now** becomes unavailable while the scan is in progress.\n\nFor more information, see the Harbor documentation:\n\u003chttps://goharbor.io/docs/2.8.0/administration/vulnerability-scanning/scan-all-artifacts/\u003e.\n\nConfigure vulnerability settings in Harbor projects\n---------------------------------------------------\n\nIntegrate vulnerability scanning into your Harbor workflow to proactively manage\nthe security of your containerized applications and protect your organization\nfrom potential threats. Configure projects so that images with vulnerabilities\ncannot be run, and to automatically scan images as soon as they are pushed into\nthe project.\n\nFollow these steps to configure vulnerability settings for a Harbor project:\n\n1. Sign in to the Harbor interface with an account that has the `ProjectAdmin` role.\n2. Go to **Projects** and select a project.\n3. Click the **Configuration** tab.\n4. To prevent vulnerable images under the project from being pulled, enable the **Prevent vulnerable images from running** checkbox.\n5. Select the severity level of vulnerabilities to prevent images from running.\n\n | **Note:** Images cannot be pulled if their level is equal to or higher than the selected level of severity. Harbor does not prevent images with a vulnerability severity of negligible from running.\n6. To activate an immediate vulnerability scan on new images that are\n pushed to the project, select the **Automatically scan images on push**\n checkbox.\n\nFor more information, see the Harbor documentation:\n\u003chttps://goharbor.io/docs/2.8.0/working-with-projects/project-configuration/\u003e."]]
