---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/it-operations-management
Release :
- yokohama
ft:locale :
- en-US
ft:publication_title :
- Yokohama IT Operations Management
ft:clusterId :
- itom
bundleId :
- itom
workflow :
- Technology
---
# Scan container images
# Scan container images {#ariaid-title1}
* Release version: Yokohama
*
* Updated March 12, 2026
*
*  2 minutes to read
Enable container image scanning using the Aqua Trivy tool.
## Before you begin
Note:
The pattern supports only the Linux operating system and runs on a Linux MID Server.
Verify the following setup:
* Discovery and Service Mapping Patterns, starting 1.7.0 (August 2023 store release).
* CMDB CI Class Models, starting 1.43.0.
* Visibility Content, starting 6.7.2.
* For the container images scan to run successfully, verify that all the MID Servers in your environment are configured for specific capabilities and are not set to All. For more information on configuring capabilities, see [MID Server capabilities](https://www.servicenow.com/docs/access?context=mid-server-capabilities&version=yokohama&pubname=yokohama-integrate-applications&ft:locale=en-US).
* MID Server requirements:
* 8GB RAM with 4GB for the Java Virtual Machine (JVM)
* MID Server Capability configured to Scan Container Images
* Can access the image repository
{#container-image-task__ul_j4r_5kv_42c}
* Aqua Trivy starting 0.44.0 is installed on the MID Server. The last version validated is 0.68.2. For more information on installing Aqua Trivy, see the [Container Image scan feature overview \[KB1218504\]](https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1218504) article in the Now Support Knowledge Base.
* To collect Docker or Kubernetes container image and environment records, you must first run the Docker or Kubernetes discovery before enabling the Container Image Scan feature. For more information, see [Kubernetes discovery using patterns](https://www.servicenow.com/docs/Nq0fHYmeSm4QYmSRUrjWJA "The ServiceNow ITOM Visibility finds Kubernetes and OpenShift components using patterns and creates application services containing them. Discovery also finds Kubernetes events and frequently updates the CMDB to reflect the dynamic Kubernetes environment.") and [Docker virtualization](https://www.servicenow.com/docs/moBGxMCYkup3w1gzKDxSWg "Discovery uses the Docker Pattern to collect data about specific objects in a Docker engine, running on a Linux host.").
* Starting with Discovery and Service Mapping Patterns version 1.18.0, the Container Image Scan feature also supports the following:
* Using a proxy MID Server to scan the container images in the following repositories: public, self-hosted private, and Amazon Elastic Container Registry (Amazon ECR) repositories. To use a proxy MID Server, ensure the MID Server proxy parameters are correctly configured. For more information on proxy parameters, see [MID Server parameters](https://www.servicenow.com/docs/access?context=mid-server-parameters&version=yokohama&pubname=yokohama-servicenow-platform&ft:locale=en-US). For information on bypassing the proxy MID Server for specific internal or private container registries, see [Configure proxy bypass for container registries](https://www.servicenow.com/docs/ya7EM3561faVzIlDmlpW4Q "Configure a proxy bypass for container image scans to reach specific internal or private registries that require a direct connection.").
* Scanning container images in self-hosted private repositories. To scan these repositories, you must create container image repository credentials. For more information, see [Create and test your credentials](https://www.servicenow.com/docs/access?context=t_CreateCredential&version=yokohama&pubname=yokohama-platform-security&ft:locale=en-US) and [Container image repository credentials](https://www.servicenow.com/docs/access?context=container-image-repo-credential&version=yokohama&pubname=yokohama-platform-security&ft:locale=en-US).
* Collecting image records from Amazon ECR in both public and private repositories. To collect these Amazon ECR image records, you must first run the Amazon ECS resource discovery before enabling the Container Image Scan. The AWS cloud service account created for the Amazon ECS resource discovery is also used for the container image scan. For more information about Amazon ECS resource discovery, see [Amazon ECS resource discovery with Patterns](https://www.servicenow.com/docs/tRIJbSQlM~dhgQQzyIz54g "The ServiceNow Discovery application uses the Amazon AWS - ECS pattern to find resources managed by the Amazon Elastic Container Service (Amazon ECS). This includes resources that are run on the Fargate launch type. Discovering some of these resources may require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.").
{#container-image-task__ul_qmf_mxb_kcc}
* Starting with version 1.27.0, Discovery and Service Mapping Patterns enables you to control whether to link software packages to containers or only to images. For more information, see [Link software package information to images only](https://www.servicenow.com/docs/5kNo~SShrhViRGgBrPskOw "Link software package information to images rather than containers to avoid empty records that associate to short-lived containers.").
* Starting with Discovery and Service Mapping Patterns version 1.30.2, you can map MID Servers to specific repositories. Use this option when network access or datacenter location requires specific MID Servers for certain repositories. For more information, see [Map MID Server to container image repository](https://www.servicenow.com/docs/NrFciiqJbdBBATvVzGaEDQ "If network access or datacenter location requires a specific MID Server, map MID Server to a private container image repository.").
{#container-image-task__ul_l11_frh_fwb}
Role required: admin
## Procedure
1. Enable the Discovery and Service Mapping Patterns Container Image Scan by setting the system property.
1. In the Navigation filter, enter sys_properties.list.
2. In the Name search field, enter sn_itom_pattern.container_image_scan.
3. Set the value to true.
{#container-image-task__ol_j5v_4mg_mwb}
2. In the URL bar enter: <instance>.service-now.com/sn_itom_pattern_container_image_scan_status_list.do to review the scan status of the images.
3. Select the image record to review the Container Image OS Packages table.
## Result
The Scan Container Image pattern finds the image OS packages and creates application records based on the image CI class. The Container Image OS Packages table is located in the image record. The pattern also creates
relationships between the configuration items. For more information on the data collected, see [Container image discovery](https://www.servicenow.com/docs/BOmE2EGoGN1BM121sCqVnQ "The Discovery and Service Mapping Patterns application uses the Scan Container Image pattern to discover Docker images and OS packages data. Discovering some of these resources may require updating to the latest version of the Discovery and Service Mapping Patterns application from the ServiceNow Store.").