Vulnerability Scanning¶

Wodby scans the container images that your app environments currently run for known vulnerabilities. Each build shows how many vulnerabilities its deployed images have, how many of them already have a fix, and the details for each image. Images are rescanned about once a day while they stay deployed, so newly published vulnerabilities appear without a rebuild.

Vulnerability scanning is available on the Team and Enterprise plans. See Billing.

What Wodby scans¶

Wodby scans an image while an enabled app service runs it, which means that the service's current deployment of the image completed. This includes derivatives, such as workers or cron services that run another service's build image. An image that several services run is scanned once.

Wodby scans only images stored in the build's own registry repository: Wodby Registry, or the Docker Hub or Distribution Registry integration the build used. Wodby uses the registry credentials of that integration, and only for that registry.

An image can be scanned when:

its registry is reachable over HTTPS at a public address
it is no larger than 2 GB, counted as the compressed size of its layers
it provides a linux/amd64 variant, or it is built for a single Linux platform, such as linux/arm64
it is a regular container image, without layers that must be downloaded from another location
it has no more than 256 layers

Results cover operating system packages and application dependencies, such as Node.js, Python, PHP, Go, or Java packages, that the scanner recognizes in the image. Wodby uses Grype and its vulnerability database, which collects advisories from Linux distributions, language ecosystems, and the National Vulnerability Database.

When scans run¶

Wodby checks every 15 minutes for deployed images that are due for a scan. Scans run one after another, so the first result for a newly deployed image can take longer when many images are waiting.

After a successful scan, Wodby rescans the image about every 24 hours while it stays deployed. After a failed scan, Wodby retries after 1 hour, and then waits twice as long after each further failure, up to 24 hours.

When a build is no longer deployed, Wodby stops rescanning its images. The build keeps showing the last result.

Read the results¶

In the list of builds, each deployed build shows its number of critical, high, medium and low vulnerabilities. The color of each number shows its severity, and hovering over it names the severity. Severities with no findings are hidden. A build with only negligible or unknown findings shows one number labelled other, and a build with no findings shows None found. Failed or Pending appears when the latest scan failed or hasn't run yet.

On a build's page, the Overview tab shows a summary of its currently deployed images:

the number of vulnerabilities for each severity: critical, high, medium, low, negligible, and unknown
the status, when it is not completed: Failed when the latest scan of any deployed image failed, and Pending when a deployed image has not been scanned yet

Builds whose images are no longer deployed show no summary. Their images still show their last result on the Vulnerabilities tab.

On the Vulnerabilities tab, select an app service to see the report for its image. A derivative that runs another service's image has no entry of its own: its results are under the app service that owns the image. A report shows the same counts, the number of fixable vulnerabilities, which have a fixed package version available, and the times of the last successful scan and the latest attempt. It also lists the image digest, platform, and the date of the vulnerability database used. For each vulnerability, the report shows:

the vulnerability ID, such as a CVE or GitHub advisory ID, and related IDs
the severity
the affected package, its version and type
whether a fix is available, and the fixed versions
a link to the advisory
the location of the package in the image

A report keeps up to 1,000 vulnerabilities per image, starting with the most severe and fixable ones. The counts always include every vulnerability found.

If a rescan fails, the report keeps showing the results of the last successful scan together with the reason the latest scan failed. Wodby retries automatically.

Weekly organization report¶

On the Team and Enterprise plans, the weekly organization report lists the builds that are currently deployed and have critical or high vulnerabilities. Each entry shows the app environment, the build number, its services, the critical and high counts, and the scan date, and links to the build. A report lists up to 30 builds and says how many more there are.

Troubleshooting failed scans¶

Message	What to do
The image was not found in its registry.	The image is missing from the registry, for example because it was deleted there. Build and deploy the app service again.
The registry rejected the credentials used to pull the image.	Check that the registry integration's credentials can still pull images from the repository.
The image registry could not be reached.	Wodby retries automatically. Check the registry's availability if the error persists.
The image registry address is not allowed for scanning. Only public HTTPS registries are supported.	Registries on private networks cannot be scanned.
The image format is not supported for scanning.	Images with more than 256 layers or with foreign or remotely hosted layers, and artifacts that are not container images, cannot be scanned.
The image does not provide a linux/amd64 variant.	Build the image for `linux/amd64`, or for a single Linux platform.
The image is larger than the 2G scanning limit.	Reduce the image size, for example with a multi-stage build.
The scan did not finish within 20m0s.	Wodby retries automatically. Very large images can keep reaching the limit.
The vulnerability database is temporarily unavailable.	Wodby retries automatically. No action is needed.
The vulnerability scanner is temporarily unavailable.	Wodby retries automatically. No action is needed.
The registry integration used by this build is no longer available.	The integration was deleted or is no longer shared with the app's project. Build and deploy with an available registry.
The image is no longer available for scanning.	The image was voided or removed while it waited for its scan. No action is needed.
The image is not stored in the build's registry repository, so it was not scanned.	The CI pipeline reported an image from another registry or repository. Push images to the repository that Wodby assigns to the build.
The vulnerability scanner could not analyze the image.	Wodby retries automatically. Contact support if the error persists.

Plan changes¶

As soon as a downgrade to the Developer plan is scheduled, Wodby stops scanning and hides results, even though the paid period continues. Upgrading again shows the stored results, and Wodby rescans deployed images.