Hello,
I am a PhD Student at University of Texas At San Antonio (UTSA) and I am doing research on container security and performance. I wanted to know how google artifact registry detects vulnerabilities in container images, like does it work by detecting packages or by analyzing something else? Or does it use any type of scanning tools, or does it use its own. I am scanning official images from DockerHub and scanning them using Snyk, Trivy and Clair. I also uploaded images in Google Artifact Registry and the results do not really match, so I am curious regarding what tools does Registry use. Also what database does Google Artifact use? The tools use a combination of VulDB, NVD, Alpine-Sec, RHEL and other databases. Does google use the same?
This is my first question here, so forgive me if I made any mistake.
Any sort of reply will be highly appreciated.
Thank You.
LinkedIn
Twitter
