Leavory Image Scan · Free
Paste an image.
We watch it every day.
Add up to five container images, public or private. Leavory scans them right away and again every day, with the actively exploited vulnerabilities at the top. Free with a Leavory account, no time limit.
How it works
Three steps, then nothing to do.
Tell Leavory which images your teams run. From then on, every image is scanned again each day, so a vulnerability published last night shows up in the morning, without a pipeline run or anyone clicking scan.
Images
Exploited first, then by severity| Image | Last scan | Critical | High | Status |
|---|---|---|---|---|
| nginx:1.27docker.io | Today, 00:00 | 1 | 4 | Exploited |
| acme/payments-api:2.14.0ghcr.io · private | Today, 00:00 | 1 | 3 | Critical |
| node:20-alpinedocker.io | Today, 00:00 | 0 | 2 | High |
| dotnet/aspnet:8.0mcr.microsoft.com | Today, 00:00 | 0 | 1 | High |
| redis:7.2docker.io | Today, 00:00 | 0 | 0 | Clean |
-
1. Add a registry, if you need one
Only for private images. Use a read-only credential: Leavory tests it before saving and keeps it encrypted.
-
2. Paste your images
As
registry/repository:tag, for exampledocker.io/library/nginx:1.27. Each one is scanned right away. -
3. Read the result, every day
A new scan every day at 00:00 UTC, the exploited vulnerabilities first, and how long each CVE has been public.
Registries
Public or private.
Public images need nothing but their name. For private ones, add up to three registry logins per account, from these managed registries.
Accepted registries
- Docker Hub
- GitHub Container Registry
- Quay
- GitLab
- Azure Container Registry
- Google Artifact Registry
Self-hosted registries such as Harbor, Nexus, or Artifactory are not accepted by default. Talk to us if you need one.
More images
When five images are not enough.
Image Scan shows the result in the hub. Leavory Workspace watches every image your teams run and tells you the moment one of them gets worse.
-
Every image, twice a day
No limit on images, grouped into projects, with a full scan at 00:00 and 12:00.
-
Alerts where your team works
An alert as soon as an image gets worse, by email, Microsoft Teams, or Slack.
-
What actually runs
The images running in your Kubernetes clusters, read by an agent in the cluster. The images never leave it.
Questions
Before you start.
How long can I use it?
As long as you like. The free plan has no time limit: up to five images per account, scanned every day.
Do I need write access to my registry?
No. Image Scan only pulls images. Use a dedicated, read-only credential limited to the repositories you scan, never a personal password, the registry admin, or a pipeline's push token. Leavory can't see a credential's scope, so keeping it read-only is up to you.
Where is my registry password kept?
The login is tested before it is saved and stored encrypted. The hub never shows the password again.
Can I use a self-hosted registry?
Not by default: Harbor, Nexus, Artifactory, and other self-hosted registries need a word with our team first.
How do I scan more than five images?
Talk to us. Leavory Workspace watches every image, twice a day, with alerts by email, Microsoft Teams, and Slack.
See Leavory in action.
Tell us which platform you use, and an engineer, not a sales bot, will reach out to schedule a demo.