[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eArtifact Analysis automatically scans container images in Artifact Registry and Container Registry for vulnerabilities when the Container Scanning API is enabled.\u003c/p\u003e\n"],["\u003cp\u003eYou can enable the Container Scanning API for a project to automatically scan newly pushed images, with the understanding that billing begins immediately upon enabling.\u003c/p\u003e\n"],["\u003cp\u003eScanning can be disabled on individual repositories within Artifact Registry to manage scanning costs and reduce the number of vulnerability findings.\u003c/p\u003e\n"],["\u003cp\u003eDisabling the Container Scanning API stops scanning for all repositories in a project, but previously configured individual repository settings are preserved.\u003c/p\u003e\n"],["\u003cp\u003eThe default monitoring time for scanned images is 30 days; to extend this, images must be pulled or pushed within that period.\u003c/p\u003e\n"]]],[],null,["# Enable or disable automatic scanning\n\nThis document tells you how to enable and disable automatic scanning.\n\nArtifact Analysis provides automated vulnerability scanning for\ncontainer images in Artifact Registry through the Container Scanning API.\nPlatform administrators and application developers can\nuse the scan results to identify and mitigate risks to their software supply\nchain.\n\nBy default, Artifact Analysis scans all supported package types in your\nproject when you enable the Container Scanning API. To lower costs and\nreduce noise in scanning findings, you can disable scanning on individual\nrepositories. For more information, see\n[Control scanning settings for an individual repository](#disable-repo).\n\nSee the [Pricing page](/artifact-analysis/pricing#vulnz) for pricing\ninformation.\n\nLimitations\n-----------\n\nThe automatic scanning feature has the following limitations:\n\n- Scanning isn't supported in Artifact Registry virtual repositories.\n- Artifact Registry repositories must be in Docker format.\n\nEnable the Container Scanning API\n---------------------------------\n\n| **Important:** When you enable the Container Scanning API, billing begins immediately. Once you enable the API for a project, Artifact Analysis automatically scans each newly pushed image to Artifact Registry in that project.\n\nYou can enable the Container Scanning API for an existing project, or create a\nnew project and then enable the API. Enabling the Container Scanning API also\nenables the Container Analysis API for metadata storage and retrieval.\n\nTo enable vulnerability scanning for your project in Artifact Registry,\ncomplete the following steps:\n\nIn the Google Cloud console, open the **Enable access to API** page:\n\n[Enable the Container Scanning API](https://console.cloud.google.com/flows/enableapi?apiid=containerscanning.googleapis.com)\n\nControl scanning settings for an individual repository\n------------------------------------------------------\n\nThis section explains how to control the scanning settings for individual\nrepositories. This feature is only supported in Artifact Registry.\n\nBy default, enabling the Container Scanning API activates scanning for all\nimages you push to standard and remote Docker repositories in Artifact Registry.\nScanning with Artifact Analysis provides comprehensive information about\npotential threats to your software supply chain. You can also disable scanning\non individual repositories if needed.\n\nYou can disable scanning on repositories to:\n\n- Manage your scanning costs within a project. You don't need to turn off scanning for an entire project, or create a new project to isolate repositories.\n- Reduce the number of vulnerability findings you receive. You can focus on remediating vulnerabilities in specific repositories.\n\nTo change scanning settings for existing Artifact Registry repositories, do the\nfollowing: \n\n### Console\n\n1. Open the **Repositories** page in the Google Cloud console.\n\n [Open the Repositories page](https://console.cloud.google.com/artifacts)\n2. In the repository list, select the repository and click **Edit Repository**.\n\n3. **Enable** or **disable** vulnerability scanning.\n\n4. Click **Save**.\n\n### gcloud\n\nTo disable scanning on the repository: \n\n gcloud artifacts repositories update \u003cvar translate=\"no\"\u003eREPOSITORY\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT-ID\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --disable-vulnerability-scanning\n\nTo allow scanning on the repository: \n\n gcloud artifacts repositories update \u003cvar translate=\"no\"\u003eREPOSITORY\u003c/var\u003e \\\n --project=\u003cvar translate=\"no\"\u003ePROJECT-ID\u003c/var\u003e \\\n --location=\u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e \\\n --allow-vulnerability-scanning\n\nWhere:\n\n- \u003cvar translate=\"no\"\u003eREPOSITORY\u003c/var\u003e: The name of the repository. If you configured a [default](/artifact-registry/docs/repositories/gcloud-defaults) repository, then you can omit this flag to use the default.\n- \u003cvar translate=\"no\"\u003ePROJECT-ID\u003c/var\u003e: The Google Cloud project ID. If this flag is omitted, then the current or default project is used.\n- \u003cvar translate=\"no\"\u003eLOCATION\u003c/var\u003e: Use this flag to view repositories in a specific location. If you configured a [default](/artifact-registry/docs/repositories/gcloud-defaults) location, then you can omit this flag to use the default.\n\nTo configure scanning settings for a new Artifact Registry repository, see\n[Create standard repositories](/artifact-registry/docs/repositories/create-repos)\nor\n[Create remote repositories](/artifact-registry/docs/repositories/remote-repo).\n\nDisable the Container Scanning API\n----------------------------------\n\nThis section explains how to disable vulnerability scanning for your project\nin Artifact Registry.\n\nWhen you disable the Container Scanning API, scanning stops for all repositories\nin your project. Scanning settings for individual repositories are preserved. If\nyou previously disabled scanning on some repositories, and later re-enable the\nAPI for your project, those repositories will remain excluded from scanning.\n\nTo update scanning settings for individual repositories, see\n[Update repositories](/artifact-registry/docs/repositories/update-repo-settings). \n\n### Console\n\n1. Open the **Settings** page for Artifact Registry:\n\n [Open the Settings page](https://console.cloud.google.com/artifacts/settings)\n2. In the **Vulnerability Scanning** section, click **Disable**.\n\n### gcloud\n\nRun the following command: \n\n gcloud services disable containerscanning.googleapis.com\n\nExtend your monitoring time window\n----------------------------------\n\nArtifact Analysis continuously monitors the vulnerability\nmetadata for scanned images in Artifact Registry.\nThe default time window for continuous monitoring is 30 days. After this period\nyour images are stale and the vulnerability scanning results are no longer\nupdated.\n\nTo extend the monitoring window, you must pull or push the image within the\n30-day period. We recommend creating a scheduled task to re-push containers that\ndon't require frequent updating, for example, your Istio and proxy images.\n\nWhat's next\n-----------\n\n- [Get started with automatic scanning](/artifact-analysis/docs/quickstart-scanning-os-automatically).\n- [Understand container scanning concepts](/artifact-analysis/docs/container-scanning-overview)."]]
