SBOM and Vulnerability Scanner
The Telovix Console scans observed container images for software bill of materials (SBOM) data and known vulnerabilities. Scan results include affected packages, severity, remediation context, deployment exposure, and CycloneDX exports.
Air-gapped deployments: Install the supported scanner package supplied with the Console release. Manual scanner uploads are not supported.
How image discovery works
Sensors report the container images running on their hosts:
- On Kubernetes nodes, images are identified from pod and container inventory, including clusters using containerd or CRI-O.
- On non-Kubernetes Linux hosts, sensors discover running Docker and Podman containers through their local runtime sockets. Both system-wide and rootless installations using standard socket locations are supported.
The Console identifies images by digest when available and avoids unnecessary repeat scans within the configured rescan interval.
Podman hosts
Enable the Podman API socket on the host where the sensor runs. For system-wide containers:
sudo systemctl enable --now podman.socketFor rootless containers, run this command as the user who owns the containers:
systemctl --user enable --now podman.socketKeep these sockets local and restrict access to trusted users. Do not expose the container runtime API over the network. Images appear after the sensor's next inventory update.
Scanner requirements
SBOM scanning requires the managed scanner to be available on the Console host. If it is unavailable, queued scans remain pending until the scanner is restored.
The Console must be able to pull the image from its registry. This applies equally to images used by Docker, Podman, and Kubernetes. For an image built only on a host, publish it to a registry reachable by the Console and use that registry reference for the container. Discovery alone does not make a host's local image storage accessible to the Console.
To check scanner status, navigate to Settings > Infrastructure. The SBOM Scanner panel shows availability, version, integrity status, and whether scanning is enabled.
Scan statuses
| Status | Meaning |
|---|---|
pending | Queued and waiting for the next scan cycle |
running | Actively being scanned |
completed | Scan finished; results are available |
failed | The scan failed; open the scan to review the reason and retry it |
Listing scans
In the Console, navigate to Detect > SBOM Scanner. Use the status, cluster, and image filters to narrow the results. Open a scan to review the image identity, affected deployments, vulnerability summary, packages, timestamps, and any failure reason.
Manually queueing a scan
Requires Admin access.
In Detect > SBOM Scanner, click Scan Image. Enter the image reference and available deployment context, then queue the scan.
Discover and queue all images
Scans known images that have not been scanned within the rescan window. Requires Admin access.
In Detect > SBOM Scanner, open Queue Scan and choose the option to scan remaining observed images. The result reports how many scans were queued and how many images were skipped because they were recently scanned or already in progress.
Retrying a failed scan
Requires Operator or Admin access and applies only to failed scans.
In Detect > SBOM Scanner, filter by Failed, open the scan, and click Retry.
Exporting SBOM data
CycloneDX for a single image
In Detect > SBOM Scanner, open a completed scan and click Download CycloneDX. The export includes the component inventory for that image.
CycloneDX export for all completed scans
In Detect > SBOM Scanner, click Export All CycloneDX to download a combined document for completed scans.
Registry credentials
For images in private registries, store credentials in the Console. They are used to construct a Docker config JSON file that the scanner reads when pulling images.
Stored credentials are not shown again after they are saved.
In the Console, navigate to Settings > Infrastructure > SBOM Scanner - Registry Credentials. Click Add registry, enter the registry URL, username, and password, and save. To verify the credentials work, click Test on the credential row.
Scanner updates
In the Console, navigate to Settings > Infrastructure.
- To check for updates, click Check for Updates.
- To install an available update, click Download & Install.
- For air-gapped environments, install the refreshed Console package that includes the supported scanner.
Proxy support
If the scanner reaches registries through an HTTP or HTTPS proxy, configure the proxy in Settings > Updates.
Scanner settings
The following values are configurable from Console Settings:
- Maximum concurrent scans: maximum parallel scans (default:
2) - Scan timeout: per-scan timeout in seconds (default:
600) - Rescan interval: hours before re-scanning the same image digest (default:
24)
Limitations
- SBOM scanning requires the managed scanner to be available. There is no fallback scanner.
- Standalone Docker and Podman discovery requires the sensor to have access to the runtime's local Unix socket. Custom socket locations are not automatically discovered.
- Standalone containerd or CRI-O hosts outside Kubernetes, LXC/LXD containers, and host operating-system packages are not covered by this container-image discovery workflow.
- Local-only images and changes made inside a running container are not included in registry-image scans.
- Images in private registries require valid registry credentials before they can be scanned.
- CycloneDX export is available only for completed scans.