[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-08-19。"],[[["\u003cp\u003eArtifact Analysis offers on-demand and automatic scanning to identify vulnerabilities in operating systems and language packages within containers.\u003c/p\u003e\n"],["\u003cp\u003eAutomatic scanning includes both on-push scanning, which analyzes new images upon upload, and continuous analysis, which regularly updates metadata to reflect the latest vulnerability information.\u003c/p\u003e\n"],["\u003cp\u003eWhile automatic language package scanning is exclusively available for Artifact Registry, both scanning methods can be used for Container Registry as well.\u003c/p\u003e\n"],["\u003cp\u003eContainer Registry is deprecated and will be shut down on March 18, 2025, so users are encouraged to transition to Artifact Registry, which is now the default for new gcr.io repositories.\u003c/p\u003e\n"],["\u003cp\u003eArtifact Analysis supports vulnerability scanning for manifest lists, but it is limited to only the first Linux amd64 image in the list.\u003c/p\u003e\n"]]],[],null,["# Types of scanning\n\nArtifact Analysis provides two features for scanning your containers: on-demand scanning and automatic scanning. This document introduces the benefits of each. Artifact Analysis also provides metadata management. To learn more about how you can use scanning and metadata storage together to secure your CI/CD pipeline from end to end, see the [Artifact Analysis overview](/artifact-analysis/docs/artifact-analysis).\n\nOn-demand and automatic scanning can identify vulnerabilities in your [operating system](/artifact-analysis/docs/os-overview), and language packages ([Java](/artifact-analysis/docs/java-overview), and [Go](/artifact-analysis/docs/go-overview)). However, automatic language package scanning is only available for Artifact Registry.\n\nFor a list of supported scanning types for each registry product, view the [comparison chart](/artifact-registry/docs/transition/setup-repo#analysis).\n\nSee [pricing](/artifact-analysis/pricing) to\nlearn more about the costs associated with scanning container images.\n\nOn-demand scanning\n------------------\n\nOn-demand scanning lets you scan container images locally on your computer\nor in your registry, using the gcloud CLI. This gives you the\nflexibility to customize your CI/CD pipeline, depending on when you need to\naccess the vulnerability results.\n\nAutomatic scanning\n------------------\n\nArtifact Analysis performs vulnerability scans on your artifacts in\nArtifact Registry. Artifact Analysis also\nmonitors the vulnerability information to keep it up to date. This process\ncomprises two main tasks: on-push scanning and continuous analysis.\n\n### On-push scanning\n\nArtifact Analysis scans new images when they're uploaded to\nArtifact Registry. This scan extracts information\nabout the system packages in the container. The images are scanned only once,\nbased on the image's digest. This means that adding or modifying tags won't\ntrigger new scans, only changing the contents of the image will.\n\nArtifact Analysis only detects packages publicly monitored for\nsecurity vulnerabilities.\n\nWhen the scan of an image is completed, the produced **vulnerability result** is\nthe collection of vulnerability occurrences for that image.\n| **Important:** When you enable the Container Scanning API, billing begins immediately. Once you enable the API for a project, Artifact Analysis automatically scans each newly pushed image to Artifact Registry in that project.\n\n### Continuous analysis\n\nArtifact Analysis creates occurrences for vulnerabilities\nfound when you upload the image. After the initial scan, it continuously\nmonitors the metadata for scanned images in Artifact Registry for new vulnerabilities.\n\nArtifact Analysis receives new and updated vulnerability\ninformation from [vulnerability sources](#sources) multiple times each day. When\nnew vulnerability data arrives, Artifact Analysis updates the\nmetadata of the scanned images to keep it up-to-date. Artifact Analysis updates existing vulnerability occurrences,\ncreates new vulnerability occurrences for new notes, and deletes vulnerability\noccurrences that are no longer valid.\n\nArtifact Analysis only updates the metadata for images that were pushed\nor pulled in the last 30 days. After 30 days, the metadata will no longer be\nupdated, and the results will be stale. Furthermore, Artifact Analysis\narchives metadata that is stale for more than 90 days, and the metadata won't be\navailable in the Google Cloud console, gcloud, or by using the\nAPI. To re-scan an image with stale or archived metadata, pull that image.\nRefreshing metadata can take up to 24 hours.\n\n### Manifest lists\n\nYou can also use vulnerability scanning with manifest lists. A [manifest\nlist](https://docs.docker.com/registry/spec/manifest-v2-2/#manifest-list) is a list of pointers to manifests\nfor several platforms. They allow a single image to work with multiple\narchitectures or variations of an operating system.\n\nArtifact Analysis vulnerability scanning only supports Linux\namd64 images. If your manifest list points to more than one Linux amd64 image,\nonly the first one will be scanned; if there are no pointers to Linux amd64\nimages, you won't get any scanning results.\n\nWhat's next\n-----------\n\n- [Work with OS packages](/artifact-analysis/docs/os-overview).\n- [Work with Go packages](/artifact-analysis/docs/go-overview).\n- [Work with Java packages](/artifact-analysis/docs/java-overview)."]]
