Originally reported by ZDNet, September 2018.
Automatic Vulnerability Scanning Comes to Google Container Registry
Google announced a new security feature targeting the early stages of the CI/CD pipeline: automatic vulnerability scanning for container images built with Cloud Build, its fully managed continuous integration and delivery platform. At launch, the feature was released as a beta under the name Container Registry vulnerability scanning.
The scanner inspects OS-level packages within a container image for known vulnerabilities every time an image is pushed to Container Registry — provided the Container Analysis API is enabled on the project.
How the Scanning Works
- Trigger: Scanning is initiated automatically when a container image is pushed to Google Container Registry.
- Prerequisite: The Container Analysis API must be enabled in the Google Cloud project.
- Scope: The scanner checks for known vulnerabilities in OS packages bundled inside the image.
- Results: Vulnerability findings are surfaced through the Container Registry UI and the Container Analysis API, allowing teams to review and act on issues before deployment.
Integration with Binary Authorization
A key strength of this feature is its integration with Binary Authorization, a deploy-time policy enforcement mechanism for Kubernetes Engine (now GKE). Binary Authorization can be configured to require that images pass vulnerability scanning before they are permitted to run in a cluster. This creates a continuous security gate that spans both the build and deploy phases of the pipeline:
- Developer pushes a container image to Container Registry.
- Container Analysis API automatically scans the image for OS package vulnerabilities.
- Binary Authorization evaluates the scan results against the project’s policy.
- Only images that satisfy the policy are allowed to deploy to Kubernetes Engine.
This shift-left approach means security issues are caught before they reach production, reducing the cost and complexity of remediating vulnerabilities discovered after deployment.
Other Google Cloud Announcements from the Same Week
Google paired the container security announcement with two additional product updates:
Revamped Cloud Source Repositories (Beta)
Google refreshed Cloud Source Repositories, its managed Git hosting service, releasing an updated beta with a redesigned user interface and semantic code search capabilities. The code search is powered by the same internal search infrastructure used by Google engineers, enabling more context-aware queries across large codebases.
Cloud Memorystore for Redis — Generally Available
Google also announced the general availability of Cloud Memorystore for Redis, a fully managed in-memory data store built on Google infrastructure. The service handles operational overhead including provisioning, replication, failover, scaling, and monitoring — tasks that can consume significant engineering time when running self-managed Redis. Cloud Memorystore was one of several managed database services Google introduced earlier in 2018.
Why This Matters for DevOps Teams
Embedding vulnerability scanning directly into the image push workflow removes the need for teams to manually schedule or trigger scans. Combined with Binary Authorization’s policy enforcement, it gives platform and security engineers a repeatable, automated control that does not depend on developer discipline or manual review steps. For teams already using Cloud Build and GKE, the integration requires minimal configuration changes to activate.
As container adoption grows, securing the supply chain — from source code through to running workloads — becomes a core DevSecOps concern. Features like Container Registry vulnerability scanning represent infrastructure-level tooling that moves security enforcement closer to where images are produced rather than where they are deployed.