Container images
Images in use, and images in connected registries: Docker Hub, GHCR, ECR, Artifact Registry, ACR, Quay, Harbor, GitLab, JFrog, IBM Cloud, OpenShift, Nexus or any v2 registry, on demand or on a schedule.
CONSTELLATION PRODUCT / VULNERABILITIES
Fewer CVEs to read. The right ones first.
Constellation scans what you build and what you run, ties every finding to the workloads it affects, and ranks findings by severity, exploit likelihood and exposure. Accepting a risk takes a reason, an expiry and an audit record.
Alpha · Scanning on by default · Offline mode optional01 / WHAT GETS SCANNED
From the registry to the node.#
Scans run as jobs on scanner workers in your cluster. Each job has a target type, a status and a retry history you can pause, resume, retry or cancel.
Running workloads
The discoverer records which image each workload runs, so a CVE shows the deployments and clusters exposed to it. Running workloads are rescanned automatically.
Host packages
The runtime agent reads each node’s dpkg, rpm and apk databases and reports them for matching. No package manager is shelled out.
Kubernetes itself
The discoverer reports platform facts, such as distribution and components, which are scanned as their own target.
Source checkouts
constellationctl repository scan builds a package list from a checkout with Syft and sends it for matching. Results are kept for 90 days by default.
AWS Lambda
constellationctl serverless aws-lambda sync reports functions; the scanner unpacks each bundle and inventories it. AWS Lambda only, pushed from the CLI.
02 / ENGINES
Three open-source engines, one finding.#
Syft builds the package inventory. Trivy and Grype both match it against their vulnerability databases and corroborate each other. Results are merged per CVE and package, and each finding records which engines reported it.
- Secret detection through Trivy, on by default
- Image signature checks with cosign, keyless by default or with your public key
- File-risk and image-configuration checks on every image
- Databases refreshed every 6 hours by default; change it from the console, or refresh now
Running all three engines takes memory. The chart starts each scanner at one scan at a time; raise concurrency or replicas once you have sized them.
SETTINGS / SCANNER & CVE SOURCESCONSTELLATION
03 / PRIORITIZE
Rank by what can actually hurt you.#
Every finding gets a 0–100 risk score. It combines CVSS severity, the FIRST EPSS exploit probability, whether the CVE is on the CISA Known Exploited Vulnerabilities list, and reachability when it is known. Asset criticality, policy violations and network exposure adjust it further.
FROM FINDING TO FIX
KEV and EPSS are imported from their public feeds every 6 hours, or from mirrors you set. The NVD importer is optional and off by default.
04 / EXCEPTIONS
Accept a risk, on the record.#
Accepting the risk of a finding needs a written reason and an expiry no more than 30 days out. An approver can be named, and it cannot be the requester. Every acceptance and suppression is written to the audit log and sent to your notification channels.
Image-level acceptances work the same way and can be revoked. The exceptions view lists them all as pending, approved, expired or suppressed.
Separate permissions govern triage, accepting risk and suppressing findings.
VULNERABILITY EXCEPTIONSCONSTELLATION
05 / PIPELINES & SBOMS
Same scanner, before the merge.#
constellationctl image-check runs the scan in-process and can fail the build at a severity you choose. Ready-made pieces exist for the common CI systems.
constellationctl / ci
constellationctl image-check <image> --fail-on high
# writes SARIF 2.1.0, JSON, SPDX 2.3 or CycloneDX 1.6
constellationctl repository scan .What is in the repository today
A GitHub Actions workflow to copy into a repository (uploads SARIF to code scanning), a GitLab CI template with a merge-request comment script, and a Jenkins shared library. These are templates, not published marketplace actions.
SBOMs for any asset or image scan export as SPDX 2.3 or CycloneDX 1.6, and findings export as CSV.
06 / RESTRICTED NETWORKS
Scan without reaching the internet.#
Offline mode stops scanners from pulling vulnerability databases. Pre-load the Trivy and Grype databases, or point Trivy at an internal OCI mirror. KEV and EPSS can come from internal mirror URLs.
Offline mode is off by default. Keeping offline databases current is your process; plan how they are approved and moved in.
values.yaml / scanner
scanner:
vulnDB:
offline: true # never pull DBs
trivyDBRepository: registry.internal/trivy-db
engines:
syft: true
trivy: true
grype: trueFAQ
Scanning questions.#
Does Constellation use its own vulnerability database?
Not today. Matching comes from Trivy’s and Grype’s databases, with Syft for inventory. Constellation adds CISA KEV and FIRST EPSS for prioritization, and an optional NVD importer for CVE details. #
Can it tell whether vulnerable code is actually reached?
Reachability feeds the risk score when it is known, and it can be recorded per finding through the API. Automatic analysis is limited to Go binaries, is experimental and is off by default. #
Does it scan infrastructure as code?
Trivy’s configuration scanning can be enabled on the scanner, and constellationctl has an iac-check command. Neither is on by default or a focus of this alpha. #
NEXT STEP
Bring your registries and your noisiest images.
Tell AlphaBravo what you scan today. We will show how Constellation ranks it.