- Home
- Container Image Scanning Tools
- Sonatype Container Scanner
Sonatype Container Scanner
Sonatype lists its headquarters at 8161 Maple Lawn Blvd #250, Fulton, Maryland 20759, United States.
What it is
Sonatype Container Scanner analyzes container images for vulnerabilities in operating-system packages and application dependencies, then applies security policies before images are pushed or deployed. It supports OCI-compliant images and can inspect remote images without a running Docker daemon. From IQ Server 1.196.0, it is the default scanner in IQ CLI and supported CI integrations, including Jenkins, GitHub Actions, GitLab, Azure DevOps, and Bamboo. Requirements are IQ Server 1.196.0 or later and IQ CLI 2.6.0 or later; the macOS IQ CLI bundle is not supported. Advanced scanning covers APK, RPM/DNF, and APT databases, while Windows container images are unsupported. The hybrid product offers registry and CI pipeline scanning. Its listed ecosystem includes Docker, Kubernetes, OpenShift, Rancher, Amazon ECS/EKS, GKE, AKS, IBM Cloud, and OKE. Pricing is on request.
For and against
For
- Scans remote images without Docker daemon
- OCI image support
- Registry and CI pipeline scanning
- Policy enforcement before deployment
- Multiple CI integrations
Against
- Pricing requires a sales quote
- Windows container images unsupported
- macOS IQ CLI bundle unsupported
- Requires specified IQ versions
The verdict
Sonatype Container Scanner combines vulnerability analysis with policy checks in build and registry workflows. Confirm platform support and required IQ versions before adoption.
Who it suits
It suits teams securing container registries and CI pipelines across the listed orchestration and cloud environments. Teams must meet the IQ Server and IQ CLI version requirements.
Plans and prices
Sonatype Container Scanner
Added to Sonatype Lifecycle; contact sales for a customized quote
Read 9 Oct 2026 · sonatype.com
On the record
- Build-time scanning
- Sonatype Container Security scans container images for known vulnerabilities and enforces security policies before images are pushed or deployed.help.sonatype.com · read 9 Oct 2026
- CI integrations
- Supported CI integrations listed for the scanner include Jenkins, GitHub Actions, GitLab, Azure DevOps, and Bamboo.help.sonatype.com · read 9 Oct 2026
- Detection
- Container scanning analyzes operating system packages and application dependencies using Sonatype vulnerability intelligence.help.sonatype.com · read 9 Oct 2026
- Image registry and orchestration ecosystem
- The container security page lists Docker, Kubernetes, OpenShift, Rancher, Amazon ECS/EKS, GKE, AKS, IBM Cloud, and OKE among supported platforms.sonatype.com · read 9 Oct 2026
- Legacy scanner status
- Support for the NeuVector-based scanner ended September 30, 2026, and it is retained only for contractual compatibility without support.help.sonatype.com · read 9 Oct 2026
- OCI support
- Sonatype supports scanning OCI-compliant container images.help.sonatype.com · read 9 Oct 2026
- OS package coverage
- Advanced Container Scanning supports APK, RPM/DNF, and APT package databases, while scanning Windows-based container images is not supported.help.sonatype.com · read 9 Oct 2026
- Product purpose
- Sonatype says its container security offerings scan images, identify risk, and enforce policies across the software development lifecycle.sonatype.com · read 9 Oct 2026
- Remote images
- The scanner can scan remote images without a running Docker daemon and eliminates the need for Docker-in-Docker.help.sonatype.com · read 9 Oct 2026
- Requirements
- The scanner requires IQ Server 1.196.0 or later and IQ CLI 2.6.0 or later; the macOS IQ CLI bundle is not yet supported.help.sonatype.com · read 9 Oct 2026
- Scanner availability
- Starting with IQ Server 1.196.0, Sonatype Container Scanner is the default container scanner in IQ CLI and supported CI integrations.help.sonatype.com · read 9 Oct 2026
- Trust and compliance
- Sonatype's Trust Center lists SOC 2, ISO 27001:2022, and NIST CSF 2.0 among its compliance programs.trust.sonatype.com · read 9 Oct 2026
