Container Registry and Software Supply Chain Platform  ·  View 16 of 33  ·  4 · Runtime

Scan Pipeline

How a scan stays inside ten minutes at 2,500 builds a day without scanning the same base layer 2,500 times.

Editable source SVG draw.io All views
Trigger Push Event on every artifact Advisory Change feed driven Scheduled Recheck weekly floor Deduplicate Layer Digest Cache Redis New layers only? Prioritise Production Queue served first Staging Queue Development Queue shed first Queue age over SLO alert, never allow Scan Trivy Pool OS + language Grype Pool second opinion Normalise purl and Advisory Ids Severity Reconcile two sources Attest Sign Result cosign · OpenVEX Push Referrer subject digest Index Findings Store Component Index cached layer verdict reused Scan Pipeline — Deduplicated and Prioritised Queue / topic Application we own Data store Decision point Risk / gap Security / platform Interface / broker batch An unchanged base layer is scanned once, not once per derived image. Push to verdict p95 ≤ 10 min. v 1.0 · owner Platform Engineering · date 2026-09

Decisions

  • Deduplicate on layer digest: an unchanged base layer is scanned once, not once per derived image
  • Two scanners, because a single scanner is a single source of truth about what is wrong with the world
  • Degrade by priority — production-bound artifacts before development — rather than uniformly

Targets

  • Push to initial verdict p95 ≤ 10 minutes for artifacts ≤ 1 GB
  • Queue age is a first-class metric; exceeding the budget is an alertable condition
  • An artifact without a completed scan is ineligible for production admission — never a silent allow

Cost

  • Layer deduplication is the single largest lever on scan compute; without it the corpus costs roughly 6× more to scan
  • Scan compute is attributed per repository and per owning team, and reported monthly
◀  Build to Attested Push All views Admission Decision  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises16-scan-pipeline