vania-janet/multiturn-rag-retrieval-data huggingface dataset:
For more information, see [Billing for storage and pull traffic](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_billing_traffic).





 Can images from other registries be scanned? 

Vulnerability Advisor scans images from IBM Cloud Container Registry only.





 How is a Vulnerability Advisor scan triggered? 

For more information about how the scanning of an image is triggered, see [Vulnerable packages](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uipackages).





 Why doesn't a new image scan? 

If you get the vulnerability report immediately after you add the image to the

registry, you might receive the following error:

BXNVA0009E: <imagename> has not been scanned. Try again later.
If this issue persists, contact support for help;
see https://cloud.ibm.com/docs/get-support?topic=get-support-getting-customer-supportgetting-customer-support

You receive this message because the images are scanned asynchronously to the requests for results, and the scanning process takes a while to complete. During normal operation, the scan completes within the first few minutes after you add the image to the registry. The time that it takes to complete depends on variables like the image size and the amount of traffic that the registry is receiving.

If you get this message as part of a build pipeline and you see this error regularly, try adding some retry logic that contains a short pause.

If you still see unacceptable performance, contact support, see [Getting help and support for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-help-and-support).





 How often are the security notices updated? 

Security notices for Vulnerability Advisor are loaded from the vendors' operating system sites approximately every 12 hours.





 Why can I see a vulnerability in Vulnerability Advisor v4 but not in v3? 

Some vulnerabilities are picked up earlier by Vulnerability Advisor version 4 than by version 3 because version 4 uses a different architecture and a different scanning engine.

Vulnerability Advisor version 3 is deprecated from 19 June 2023.
* UI
* CLI







 Managing image security with Vulnerability Advisor 

Vulnerability Advisor is provided as part of IBM Cloud® Container Registry. Vulnerability Advisor checks the security status of container images that are provided by IBM, third parties, or added to your organization's registry namespace.

Vulnerability Advisor provides security management for [IBM Cloud Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-getting-startedgetting-started). Vulnerability Advisor generates a security status report that includes suggested fixes and best practices. Vulnerability Advisor is available in two versions: version 3 and version 4. Version 4 uses new architecture and a different scanning engine.

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

When you add an image to a namespace, the image is automatically scanned by Vulnerability Advisor to detect security issues and potential vulnerabilities. If security issues are found, instructions are provided to help fix the reported vulnerability.

Any issues that are found by Vulnerability Advisor result in a verdict that indicates that it is not advisable to deploy this image. If you choose to deploy the image, any containers that are deployed from the image include known issues that might be used to attack or otherwise compromise the container. The verdict is adjusted based on any exemptions that you specified.

Fixing the security and configuration issues that are reported by Vulnerability Advisor can help you to secure your IBM Cloud infrastructure.

You can use IBM Cloud Security and Compliance Center to monitor vulnerabilities that are detected by Vulnerability Advisor. For more information, see [Getting started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).

Using Portieris to block the deployment of images with issues that are found by Vulnerability Advisor is deprecated.



 About Vulnerability Advisor 

Vulnerability Advisor provides functions to help you to secure your images.

Vulnerability Advisor version 3 is deprecated from 19 June 2023.
This action happens dynamically every time Vulnerability Advisor is queried. Therefore, no pregenerated scan result exists that requires deleting. However, the image index report is deleted within 30 days of the deletion of the image from the registry.







 Types of vulnerabilities 



 Vulnerable packages 

Vulnerability Advisor checks for vulnerable packages in images that are using supported operating systems and provides a link to any relevant security notices about the vulnerability.

Packages that contain known vulnerability issues are displayed in the scan results. The possible vulnerabilities are updated daily by using the published security notices for the Docker image types that are listed in the following table. Typically, for a vulnerable package to pass the scan, a later version of the package is required that includes a fix for the vulnerability. The same package can list multiple vulnerabilities, and in this case, a single package update can address multiple vulnerabilities.

Vulnerability Advisor returns vulnerabilities only when a package fix is published by the distributor. Declared vulnerabilities that aren't fixed yet, or are not going to be fixed, are not reported by Vulnerability Advisor. Therefore, if Vulnerability Advisor does not report any vulnerabilities, there might still be a risk in the image.

For version 3, the scanning of an image is triggered in one of the following ways:



* When a new image is pushed to the registry.
* When a new security notice is released for a package that is installed in the image, the image is queued for scanning, which might take some time to complete.
* While an image is tagged in the registry, it is scanned every week.



Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

For version 4, the image is indexed the first time that it is pushed. Thereafter, the vulnerability assessment is calculated every time Vulnerability Advisor is queried about that image.

The following tables show the supported Docker base images that Vulnerability Advisor checks for vulnerable packages.
Image Vulnerability Scanner: By default, Vulnerability Advisor scans images that are stored in IBM Cloud Container Registry to find potential security vulnerabilities. For more information, see [Managing image security with Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index).
4. IBM Cloud Security and Compliance Center: When you enable IBM Cloud Security and Compliance Center, you can view reports about suspicious incoming and outgoing network traffic. For more information, see [What is IBM Cloud Security and Compliance Center?](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).
5. IBM Cloud® Secrets Manager: You can store your Ingress and Kubernetes secrets in IBM Cloud® Secrets Manager. When you integrate Secrets Manager into your cluster, you set a default Secrets Manager instance where all Ingress subdomain secrets are uploaded. For more information, see [Setting up Secrets Manager in your Kubernetes Service cluster](https://cloud.ibm.com/docs/containers?topic=containers-secrets-mgr).







 Image and registry 

Every deployment is based on an image that holds the instructions for how to spin up the container that runs your app. These instructions include the operating system inside the container and extra software that you want to install. To protect your app, you must protect the image and establish checks to ensure the image's integrity.

Should I use a public or a private registry to store my images?
: Public registries, such as Docker Hub, can be used to get started with Docker images and Kubernetes to create your first containerized app in a cluster. But when it comes to enterprise applications, avoid registries that you don't know or don't trust to protect your cluster from malicious images. Keep your images in a private registry, like the one provided in IBM Cloud Container Registry and make sure to control access to the registry and the image content that can be pushed.

Why is it important to check images against vulnerabilities?
: Research shows that most malicious attacks leverage known software vulnerabilities and weak system configurations.
The images that are not eligible are still displayed, but they do not count toward the total number of images that is set in the retention policy and are not removed.
* What regions are available?

 What regions are available? 

To find out about the regions that are available for IBM Cloud Container Registry, see [Regions](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_regions).
* How much does Vulnerability Advisor cost?

 How much does Vulnerability Advisor cost? 

The cost of Vulnerability Advisor is built into the pricing for IBM Cloud Container Registry. For more information, see [Billing for storage and pull traffic](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewregistry_billing_traffic).
* Can images from other registries be scanned?

 Can images from other registries be scanned? 

Vulnerability Advisor scans images from IBM Cloud Container Registry only.
* How is a Vulnerability Advisor scan triggered?

 How is a Vulnerability Advisor scan triggered? 

For more information about how the scanning of an image is triggered, see [Vulnerable packages](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uipackages).
* Why doesn't a new image scan?

 Why doesn't a new image scan? 

If you get the vulnerability report immediately after you add the image to the registry A storage and distribution service that contains public or private images that are used to create containers., you might receive the following error:

BXNVA0009E: <imagename> has not been scanned. Try again later.
If this issue persists, contact support for help;
see https://cloud.ibm.com/docs/get-support?topic=get-support-getting-customer-supportgetting-customer-support

You receive this message because the images are scanned asynchronously to the requests for results, and the scanning process takes a while to complete. During normal operation, the scan completes within the first few minutes after you add the image to the registry.
If this issue persists, contact support for help;
see https://cloud.ibm.com/docs/get-support?topic=get-support-getting-customer-supportgetting-customer-support

You receive this message because the images are scanned asynchronously to the requests for results, and the scanning process takes a while to complete. During normal operation, the scan completes within the first few minutes after you add the image to the registry. The time that it takes to complete depends on variables like the image size and the amount of traffic that the registry is receiving.

If you get this message as part of a build pipeline and you see this error regularly, try adding some retry logic that contains a short pause.

If you still see unacceptable performance, contact support, see [Getting help and support for Container Registry](https://cloud.ibm.com/docs/Registry?topic=Registry-help-and-support).
* How often are the security notices updated?

 How often are the security notices updated? 

Security notices for Vulnerability Advisor are loaded from the vendors' operating system sites approximately every 12 hours.
* Why can I see a vulnerability in Vulnerability Advisor v4 but not in v3?

 Why can I see a vulnerability in Vulnerability Advisor v4 but not in v3? 

Some vulnerabilities are picked up earlier by Vulnerability Advisor version 4 than by version 3 because version 4 uses a different architecture and a different scanning engine.

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).
* Which version of a package is installed in my image?

 Which version of a package is installed in my image? 

To determine the version of a package that is installed in your image, use the relevant package manager command for your operating system.



 Alpine package manager commands 

On Alpine, to determine the version of a package that is installed in your image, you can use the following commands, where <package_name> is the name of your package.
Image Vulnerability Scanner: By default, Vulnerability Advisor scans images that are stored in IBM Cloud Container Registry to find potential security vulnerabilities. For more information, see [Managing image security with Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index).
4. IBM Cloud Security and Compliance Center: When you enable IBM Cloud Security and Compliance Center, you can view reports about suspicious incoming and outgoing network traffic. For more information, see [What is IBM Cloud Security and Compliance Center?](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).
5. IBM Cloud® Secrets Manager: You can store your Ingress and Kubernetes secrets in IBM Cloud® Secrets Manager. When you integrate Secrets Manager into your cluster, you set a default Secrets Manager instance where all Ingress subdomain secrets are uploaded. For more information, see [Setting up Secrets Manager in your Kubernetes Service cluster](https://cloud.ibm.com/docs/openshift?topic=openshift-secrets-mgr).







 Container runtime 

Your worker nodes are installed with [CRI-O](https://cri-o.io/) as the container runtime interface, which is protected by the [Security-Enhanced Linux (SELinux)](https://www.redhat.com/en/topics/linux/what-is-selinux) labeling system.

When you use Kubernetes to interact with a container image, such as by creating a pod, the kubelet communicates with CRI-O through a Unix socket, crio.sock. The Unix socket uses the SELinux labels in the following table to enforce the appropriate system access policies. These labels prevent user containers from being able to access the container runtime socket.



SELinux labels that are used to protect container runtime processes.

 Process SELinux label 

 CRI-O system_u:system_r:container_runtime_t:s0 
 kubelet system_u:system_r:unconfined_service_t:s0
For more information, see [Getting started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).

Using Portieris to block the deployment of images with issues that are found by Vulnerability Advisor is deprecated.



 About Vulnerability Advisor 

Vulnerability Advisor provides functions to help you to secure your images.

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

The following functions are available in version 3:



* Scans images for issues.
* Provides an evaluation report that is based on security practices that are specific to IBM Cloud Kubernetes Service.
* Provides recommendations to secure configuration files for a subset of application types.
* Provides instructions about how to fix a reported [vulnerable package](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexpackages) or [configuration issue](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexapp_configurations) in its reports.
* Applies exemption policies to reports at an account, [namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_namespace), [repository](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_repository), or [tag](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_tag) level to mark when issues that are flagged do not apply to your use case.



The following functions are available in version 4:



* Scans images for issues.
* Provides an evaluation report that is based on security practices that are specific to IBM Cloud Kubernetes Service.
container-registry.account-vulnerability-report.list View the Vulnerability Advisor reports for images in your Container Registry account.<br><br>For more information about request data, see [Request data for the account vulnerability report](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze_report_list). 
 container-registry.account-vulnerability-status.list View Vulnerability Advisor security status for images in your Container Registry account.<br><br>For more information about request data, see [Request data for the account vulnerability status](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze_status_list). 
 container-registry.image-vulnerability-report.read View the Vulnerability Advisor report for an image in Container Registry.<br><br>For more information about request and response data, see [Request and response data for the vulnerability report](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze_report_read). 
 container-registry.image-vulnerability-status.read View the Vulnerability Advisor security status for an image in Container Registry.<br><br>For more information about request and response data, see [Request and response data for the vulnerability status](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze_status_read). 







 Actions that generate events for exemption policies 



Table 17. Actions that generate events for Vulnerability Advisor exemption policies

 Action Description Data Event 

 container-registry.exemption.create Create a Vulnerability Advisor exemption. 
 container-registry.exemption.delete Delete a Vulnerability Advisor exemption. 









 Analyzing Activity Tracker events 

The following fields are populated as described, depending on how you populate the request:



* target.name shows the image name and, if you request an image name with a tag, a tag. If you request an image name by digest, the digest is shown instead of the tag because the digest might have many tags.
For more information, see [Getting started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).

Using Portieris to block the deployment of images with issues that are found by Vulnerability Advisor is deprecated.



 About Vulnerability Advisor 

Vulnerability Advisor provides functions to help you to secure your images.

Vulnerability Advisor version 3 is deprecated from 19 June 2023. For more information about how to update to version 4, see [Update Vulnerability Advisor to version 4 by 19 June 2023](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_va_v4&interface=ui).

The following functions are available in version 3:



* Scans images for issues.
* Provides an evaluation report that is based on security practices that are specific to IBM Cloud Kubernetes Service.
* Provides recommendations to secure configuration files for a subset of application types.
* Provides instructions about how to fix a reported [vulnerable package](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uipackages) or [configuration issue](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiapp_configurations) in its reports.
* Applies exemption policies to reports at an account, [namespace](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_namespace), [repository](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_repository), or [tag](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overviewoverview_elements_tag) level to mark when issues that are flagged do not apply to your use case.



The following functions are available in version 4:



* Scans images for issues.
* Provides an evaluation report that is based on security practices that are specific to IBM Cloud Kubernetes Service.
Push images with trusted content only Ensure the integrity of your images by enabling [content trust](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_trustedcontentregistry_trustedcontent) in your image repository. With trusted content, you can control who can sign images as trusted and push images to a specific registry namespace. After trusted signers push an image to a registry namespace, users can pull the signed content so that they can verify the publisher and the integrity of the image. 
 Automatic vulnerability scans When you use IBM Cloud Container Registry, you can leverage the built-in security scanning that is provided by [Vulnerability Advisor](https://cloud.ibm.com/docs/Registry?topic=Registry-va_indexva_registry_cli). Every image that is pushed to your registry namespace is automatically scanned for vulnerabilities against a database of known CentOS, Debian, Red Hat, and Ubuntu issues. If vulnerabilities are found, Vulnerability Advisor provides instructions for how to resolve them to ensure image integrity and security. 
 Block deployments from vulnerable images or untrusted users Create an admission controller with custom policies so that you can verify container images before you deploy them. With the [open source Portieris project](https://github.com/IBM/portieris), you control where the images are deployed from and ensure that they meet content trust requirements. If a deployment does not meet the policies that you set, the admission controller blocks the deployment in your cluster. 



What options do I have to scan running containers for vulnerabilities?
: You can install third-party solutions in your cluster, such as [Twistlock](https://www.paloaltonetworks.com/prisma/cloud) or [StackRox](https://www.redhat.com/en/technologies/cloud-computing/openshift/advanced-cluster-security-kubernetes) to scan running containers and block malicious activities when they are detected.





 Container isolation and security