Container image scanning helps you detect vulnerabilities in your Docker images before and after deployment. Instead of scanning every version of every image you've ever built, Intruder lets you focus on what matters: the images you're actually running in production, staging, or other environments.

This guide will walk you through adding your first container image target and explain how tag rules work to keep your scanning focused and efficient.

Step 1: Navigate to discovery

Step 2: Find your image

Step 3: Add a target

Once added, the container image target will appear on your Targets page, and Intruder will begin scanning it automatically (and enrol it in daily scans moving forward).

You can view the scan on the Scans Page:

On the Container Images page, you can see:

Filter to show only targets:

If you've already added an image as a target and want to monitor additional tags:

What happens:

If you want to stop scanning a specific tag rule:

What happens:

Important: If an image has multiple tag rules and you delete one, only that specific rule (target) is removed. Other tag rules for the same image continue scanning.

Each vulnerability found is reported as an issue in Intruder, with severity ratings, affected package details, and remediation guidance where available.

You can view the issues we found from the container scan in three places:

(1) Issues page:

(2) Target Detail page for the container:

(3) The Scan Details page:

In that case, you just need to hit the Refresh button on the relevant cloud integrations page. For example:
​

If an image shows no tags in the discovery table, you won't be able to add it as a target yet. This typically happens when:

To fix this:

If your cloud integration already has the permissions needed for cloud security scanning, container images will be discovered automatically. If you have an older integration with limited permissions, some images might not appear. See the setup guides linked below:

Container images are discovered through your connected cloud integrations:

Note: Support for additional registries (Docker Hub, GitHub Container Registry, GitLab Container Registry) is planned for upcoming releases.

No - container image targets are scanned automatically (like cloud security scans). Three situations that will trigger a scan:

About 10 mins per image.

We check every 5 minutes to see if your configured tag now points to a new image version. For example:

If a scan is already running when we detect a new tag:

Each tag rule creates one target and consumes one infrastructure license.

The number of tags that match your pattern does NOT affect licensing. Whether production* matches 2 tags or 50 tags, it's still one target = one license. Only the most recently pushed tag will be scanned. For example:

Scenario 1: Adding only 1 rule for an image

Scenario 2: Multiple Rules For 1 Image

Yes - container image vulnerabilities appear as issues in the portal and are included in your reporting.

Yes. You can create multiple targets for the same image with different tag rules. Example Use Case: Separate Production and Staging targets; both targets are the same image: webapp.

Target 1:

Target 2:

Licensing: 2 targets = 2 licenses (one for each tag rule)

Why this matters: You can create separate targets for the same image with different tag rules to independently monitor different environments. Deleting the staging-* target won't affect your production-* scans.