Container Security
Vulnerabilities, SBOMs, signatures, and embedded secrets — before images ship.
What is the best container image scanning tool across ECR, GCR, ACR and Docker Hub?
Container images scanned across private and public registries for vulnerabilities, SBOMs generated, signatures verified, Dockerfiles linted, and embedded secrets detected — connected to the source repositories and clusters where images are built and run.
Container Security in the Offload Platform
What this replaces
Images are built daily and scanned never — or scanned in CI once and forgotten while new CVEs land. Registries multiply across clouds, and nobody knows which running image carries last week's critical.
What Offload does
Container images scanned across private and public registries for vulnerabilities, SBOMs generated, signatures verified, Dockerfiles linted, and embedded secrets detected — connected to the source repositories and clusters where images are built and run.
What you get
- Registry coverage: AWS ECR, Google Artifact Registry, Azure ACR, Docker Hub, GitHub Container Registry
- Dual-engine scanning (Trivy + Grype) with CISA KEV exploited-vulnerability enrichment
- SBOM generation (Syft) in CycloneDX, SPDX, and syft-json
- Dockerfile linting (Hadolint) and image signature verification (Cosign)
- Embedded-secret detection inside image layers (TruffleHog)
- Scheduled registry re-validation so findings stay current as new CVEs publish
- CI/CD image and artifact scanning via GitHub Action and scoped API keys
How it works
Every scan runs in an isolated, single-use scanner container — tools are never installed into the platform runtime. Registry credentials are encrypted at rest and passed through a read-only authentication flow; auth failures are classified honestly rather than reported as scan results.
Results are normalized per image with severity summaries and history for trending.
One platform, one risk view
Image findings join unified vulnerability management, link to the repositories that build them and clusters that run them, and can gate CI/CD pipelines through the release-gate integration.
Solutions built on Container Security
SaaS & Technology
Code-to-cloud coverage with release gates in CI, SBOMs your enterprise customers ask for, and security-questionnaire automation that turns procurement reviews from weeks into hours — all in one governed risk view.
SBOM & license governance
Generate, ingest and police SBOMs, classify licenses into six families with a policy gate, and produce NOTICE files legal can ship — so supply-chain questions have an answer before due diligence asks them.
Other modules on the platform
Container Security — frequently asked questions
Which container registries does Offload Security scan?
AWS ECR, Google Artifact Registry, Azure ACR, Docker Hub and GitHub Container Registry, with encrypted read-only registry credentials.
Which engines does Offload use for image scanning?
Dual-engine scanning with Trivy and Grype (enriched with CISA KEV), plus Syft SBOMs, Hadolint Dockerfile linting, Cosign signature verification and TruffleHog secret detection in image layers.
Does Offload keep image findings current as new CVEs publish?
Yes. Scheduled registry re-validation re-scans images so findings stay current instead of going stale after a one-time CI scan.