docs: add container image inventory page#1392
Conversation
Introduced a comprehensive guide on container image inventory, detailing features, benefits, and usage instructions.
✅ Snyk checks have passed. No issues have been found so far.
💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse. |
Updated image paths in the container image inventory documentation to reflect the correct directory structure.
Updated the section to clarify how the container image inventory works and what challenges it addresses.
|
|
||
| Container image inventory is a unified view in the Snyk platform that consolidates all of your container images into a single, manageable list, regardless of where they were scanned. | ||
|
|
||
| Instead of navigating a fragmented set of per-scan Projects, you get one authoritative inventory of unique container image assets, each identified by **Registry + Repository + Config Digest**. A single image scanned from a registry import, from the CLI, and a Kubernetes workload all appear as **one asset** with a single, deduplicated issue count. |
There was a problem hiding this comment.
We have identified that an assets true identity is actually: "registry+ rep+ manifest digest+ config digest. We have a ticket to make this change! If we call this out, will it confuse customers ?
I trust your expertise here @pbanerji-sn !
| | **Unified asset list** | View all unique container images across your Organization or Group in one place | | ||
| | **Deduplicated issue counts** | Issues from multiple scan sources are merged — no more inflated counts | | ||
| | **Version grouping** | Group images by repository to explore the full version history of an image | | ||
| | **Search and filter** | Filter by registry, image repository, tag, image labels, digest, class, and more | |
There was a problem hiding this comment.
nit: maybe split up search and filter since they support different fields?
|
|
||
| Container image inventory identifies each unique image by its **Registry + Repository + Config Digest**. Because this identity is based on the immutable config digest rather than a mutable tag, one image scanned from the CLI, a container registry, and a Kubernetes workload appears as a single asset — not three separate Projects. | ||
|
|
||
| Issues from all scan sources are merged and deduplicated, so you see one count per unique vulnerability rather than inflated totals from overlapping scans. Images are grouped by repository, giving you a version history view where you can compare build dates, risk scores, and issue counts across digests and spot regressions over time. Each asset also surfaces key metadata — tags, inferred base image, test surface, and last scan date — in one place. |
There was a problem hiding this comment.
Technically images are grouped by registry/repo... unsure if it is important to call this out though as the language we use in the UX is group by: image repository
|
|
||
|  | ||
|
|
||
| You can sort the flat view by build date, score, issue count, last scan, class, discovered, or updated — in ascending or descending order — using the sort control in the top-right corner. |
There was a problem hiding this comment.
Should we add that this will be extended to the grouped view in the future ?
|
|
||
|  | ||
|
|
||
| A **search bar** is also available in the top-right corner. Search matches across asset name, image tags, registry, repository, and digests. |
There was a problem hiding this comment.
We should probably be more specific here since customers have already raised this. Right now the search feature only does prefix matching, it matches from the start of a string, so typing the middle of a string will not find a match.
| A **search bar** is also available in the top-right corner. Search matches across asset name, image tags, registry, repository, and digests. | ||
|
|
||
| {% hint style="info" %} | ||
| The search bar matches from the beginning of the asset name field. If you cannot find a specific image, try using the **Repository** or **Image tag** filters instead. |
bdemeo12
left a comment
bdemeo12
left a comment
There was a problem hiding this comment.
LGTM! Just a few nits!!!
|
|
||
| Depending on how you scan containers, you may need to take the following steps to ensure your images appear in the inventory: | ||
|
|
||
| - **CLI users** — Upgrade to the latest Snyk CLI (which bundles an updated snyk-docker-plugin) and re-run `snyk container monitor` for your images. |
There was a problem hiding this comment.
Confirmed CLI version 1.1303.0 and onwards supports assets
| Depending on how you scan containers, you may need to take the following steps to ensure your images appear in the inventory: | ||
|
|
||
| - **CLI users** — Upgrade to the latest Snyk CLI (which bundles an updated snyk-docker-plugin) and re-run `snyk container monitor` for your images. | ||
| - **Container Registry integrations** — Newly imported images automatically populate the inventory. For existing Projects, assets appear when a new image digest is pushed to a monitored tag. |
There was a problem hiding this comment.
Assets will appear when they are retested - manually via the UI or on recurring tests
| - **Last seen** — When Snyk last confirmed the asset exists in your environment | ||
| - **Last tested** — When Snyk last scanned the asset | ||
| - **Source** — The origin of the asset | ||
| - **Tags** — Snyk asset tags |
There was a problem hiding this comment.
We might remove Snyk asset tags + snyk asset labels - if so, we should remove these as well
|
|
||
|  | ||
|
|
||
| Groups are sorted alphabetically by image name by default. You can expand any group to reveal the individual image assets within it. Each asset row within the group displays: |
There was a problem hiding this comment.
Groups are sorted alphabetically by image name by default
Small thing, but we changed this to be sorted by -built_at, most recent build date, in response to sort by name being slower
| | :--- | :--- | | ||
| | **Asset name** | Registry, repository, and a short config digest identifier (for example, `alpine-base@a23a90a4`) | | ||
| | **Image tags** | The distinct set of tags seen across all discovery sources for this asset | | ||
| | **Build date** | The date the image was built | |
There was a problem hiding this comment.
nit: assuming we keep asset class, we also display that in the table. Maybe worth bringing up briefly and mentioning that it's configurable?
|
|
||
|  | ||
|
|
||
| You can sort the flat view by build date, score, issue count, last scan, class, discovered, or updated — in ascending or descending order — using the sort control in the top-right corner. Sorting currently applies to the flat view; support for sorting the grouped view is planned for a future release. |
There was a problem hiding this comment.
support for sorting the grouped view is planned for a future release.
Going to see how complicated the dual sort component would be to implement. I think it would just be UI work. If it can be done relatively easily, I can make a PR for it
| | **Manifest digest** | Filter by manifest digest | | ||
| | **Registry** | Filter by container registry hostname | | ||
| | **Repository** | Filter by image repository | | ||
| | **Type** | Filter by asset type | |
There was a problem hiding this comment.
nit: recently removed Type from the filter options because the way SBOM was implemented, asset types are split into different tabs entirely
|
|
||
|  | ||
|
|
||
| A **search bar** is also available in the top-right corner. Search uses prefix matching against the asset name field: it matches only from the beginning of the string, so entering text that appears in the middle of an asset name will not return a match. |
There was a problem hiding this comment.
Search uses prefix matching against the asset name field
nit: might be worth clarifying here that the name field includes the asset's registry/repository if they exist. For example, in Kate's org, if I search for "docker.io/snyk/kubernetes" then the "kubernetes-monitor" asset shows up. But if I just search for "kubernetes," nothing shows up
|
|
||
| ### Asset details | ||
|
|
||
| Click any asset row to open a side drawer with detailed information. The drawer contains four tabs: **Overview**, **Issues**, **Fix Recommendations**, and **Related Projects**. |
There was a problem hiding this comment.
Will this also contain "Image content" after the provenance attestation UI changes are merged in?
| - **Asset ID** — The unique identifier for this asset | ||
| - **Type** — The asset type (Container Image) | ||
| - **Class** — The risk classification (A through E) | ||
| - **Discovered** — When Snyk first identified this asset |
There was a problem hiding this comment.
Very small nit: also added "Test Surface" in this section recently
| | Column | Description | | ||
| | :--- | :--- | | ||
| | **Severity** | The severity level (critical, high, medium, low) | | ||
| | **Score** | The risk/priority score for this specific issue | |
There was a problem hiding this comment.
We're only using risk score now, and it will only show up (both in the asset table and issues table) if the customer has explicitly enabled risk score for their group/org under the "Snyk Preview" settings and their projects get re-scanned. Maybe worth bringing this up, since we mention risk score a lot in these docs?
| | **Target Reference** | The target reference associated with the Project | | ||
| | **Actions** | Links to the Project details page | | ||
|
|
||
| You can sort the list by highest date last tested, and use **Modify columns** to customize which columns are displayed. |
There was a problem hiding this comment.
You can sort the list by highest date last tested
What do you think of "highest" -> "newest," or just "You can sort the list by date last tested or issue count?"
4 participants
New documentation page for the Container Image Inventory feature (GA).
Covers:
Screenshot placeholders use
.gitbook/assets/container-inventory-*.pngpaths — images to be added before merge.cc @snyk/docs for review
Note
Low Risk
Documentation-only addition with no application or security code changes.
Overview
Introduces
docs/manage-assets/container-image-inventory.md, a new GitBook page for the Container Image Inventory feature at GA.The page explains the unified Registry + Repository + Config Digest asset model, deduplicated issues, and how Org vs Group navigation works (Org-only new inventory; Group banner to try the new experience alongside legacy Asset Inventory). It documents setup for CLI (≥1.1303.0 + re-
monitor), registry imports/retests, and Kubernetes (snyk-monitorupgrade), plus grouped/flat views, filters, prefix search, and the asset drawer tabs (Overview, Issues, Fix Recommendations, Related Projects). Persona workflows, Enterprise prerequisites, known limitations, and FAQs are included.Screenshot references point to
.gitbook/assets/container-inventory-*.pngplaceholders called out in the PR as still to be added before merge. This diff does not updateSUMMARY.mdor other nav files to link the page.Reviewed by Cursor Bugbot for commit f8b5d71. Bugbot is set up for automated code reviews on this repo. Configure here.