Vulnerability Scans

Arcane scans your Docker images for known vulnerabilities (CVEs) with Trivy, an open-source scanner, and saves results per image. It ranks findings by risk so you know what to fix first, and can patch some for you.

Review affected packages and available fixes, ordered by severity.

×

Review affected packages and available fixes, ordered by severity.

Turn on scanning

1. Open Environments and click the environment.
2. On the Features tab, make sure Vulnerability management is on.
3. Under Settings → Automations, turn on the vulnerability scan job.
4. Optional: change the job’s schedule (5-field cron). The default 0 0 * * * runs daily at midnight. Changes apply without a restart.

To scan now, open Security in the sidebar and click Scan all images. Each image is scanned by Trivy from the bundled tools image (ghcr.io/getarcaneapp/tools, which pins the Trivy version) using the environment’s cache, network, resource, and server settings. Findings, severity counts, and scan duration are saved per image.

Review results

Open Security in the sidebar. The overview combines every environment you can read into one risk score and shows which images and CVEs to fix first, tagged by environment. Vulnerabilities lists every finding; Patches applies supported fixes.

Card	What it shows
Risk score	The combined score, its band, and the change from 7 days ago.
Highest-priority fix	The fixable finding with the highest risk, with its image, package, and fixed version.
Trend	Daily scores over 30 or 90 days.
Known exploited, Overdue KEV	Findings in the CISA KEV catalog, and those past CISA’s remediation due date.
Likely exploited	Findings with an EPSS probability of 10% or more.
Running critical/high, Images scanned	Critical and high findings in running containers, and how many images have been scanned.
Findings by severity, Findings by exposure	All findings, including ones without a fix.
Top vulnerabilities	The 10 highest-risk CVEs. Sort by Prevalence to see which CVEs appear in the most images.
Images to prioritize	The 5 highest-scoring images.

Filter and export results

Fixable in the Vulnerabilities table shows only findings with a known fixed version. It filters saved results only; to stop scans recording unfixable findings, turn on Only Report Fixable Vulnerabilities (see Configure scans).

Rows per page → All asks for confirmation, since loading every finding can slow the browser, and resets to 20 next time. Export CSV downloads every result matching the current search and filters (including Show ignored and Fixable) across all pages.

Patch image vulnerabilities

Arcane can patch fixable OS-package vulnerabilities with Copacetic (copa), so you don’t wait for the publisher’s fixed version.

1. Open Security → Patches. The table lists scanned images with their fixable CVE counts, last scan time, last patch status, and patched tag.
2. Click Patch on a row. You can also patch from the image detail page or the Images table row menu.
3. Follow progress in the Activity Center. Patches run in the background, one at a time, and need the images:patch permission.
4. Redeploy your containers against the new tag to use the patched image.

What happens during a patch:

• copa runs against the Docker daemon’s built-in BuildKit, with no helper container, pulling with Arcane’s stored registry credentials.
• With a stored report from the latest scan, only its vulnerabilities are patched; without one, every outdated OS package is updated.
• The result gets a tag suffix (nginx:1.25 → nginx:1.25-patched by default) in the local daemon only. Nothing is pushed and running containers aren’t touched.
• Arcane re-scans the patched image and shows the result in the Patches table.

What can’t be patched:

• Language or application dependencies (npm, pip, Go modules, and so on). Rebuild the image for these.
• Locally built images with no registry source (rebuild them), and untagged images.

Schedule patching

Turn on Scheduled Image Patching under Settings → Security → Image Patching, and set the patch job’s schedule in Automations. The default 0 3 * * * runs daily at 03:00. Each run patches local scanned images that have a stored report and no patch since their latest scan.

Configure scans

Scan settings are under Settings → Security → Vulnerability Scanning and apply to every scan there. Re-scan to refresh saved results after changes.

• Only Report Fixable Vulnerabilities records only vulnerabilities that have a known fixed version.
• Trivy Config (YAML) takes the contents of a trivy.yaml file.
• .trivyignore takes one vulnerability ID per line. Lines starting with # are comments.

Arcane’s command-line options win over the YAML: output format, timeout, cache directory, database or server settings, exit code, and fixable-only. CPU Limit (cores), Memory Limit (MB), and Concurrent Scan Containers cap the resources scans use; see Settings.

Use a remote Trivy server

A Trivy server holds the vulnerability database so each host doesn’t download and load it. This helps small or 32-bit hosts, especially armv7, where the local database may fail to load.

1. Turn on Use Remote Trivy Server.
2. Set Trivy Server URL, for example http://trivy.example.com:4954.
3. Optional: set Trivy Server Token if the server requires authentication.

Scan containers must reach the server URL; Trivy Network sets their network. The token goes in the TRIVY_TOKEN environment variable, so it stays out of process arguments.

Threat intelligence

Arcane raises the priority of vulnerabilities exploited in practice, using two public sources:

• The CISA Known Exploited Vulnerabilities (KEV) catalog of CVEs the US Cybersecurity and Infrastructure Security Agency knows are exploited.
• FIRST EPSS (Exploit Prediction Scoring System): the probability a CVE will be exploited soon.

The Vulnerability Risk job syncs both at most every 20 hours; run it from Automations to sync now. KEV comes from www.cisa.gov, and EPSS scores from api.first.org for scanned CVE IDs only. A failed sync keeps the previous data. For air-gapped installs, turn off Threat Intelligence under Settings → Security → Vulnerability Scanning. Scores then reflect only severity and container usage.

The job also computes scores hourly and records one daily snapshot in the TZ timezone. The 7-day change uses the latest 7–10-day-old snapshot. Snapshots are kept 400 days; the trend restarts when the scoring formula changes.

Reference

Risk score

A 0–100 score for each finding, image, and environment: severity weighted by exploitation and container usage.

risk = min(100, 10 × severity × threat × usage)

Severity is the CVSS (Common Vulnerability Scoring System) v3 score, or v2 if there’s no v3 score. Without either, Arcane uses the severity label: Critical 9.5, High 8, Medium 5.5, Low 2.5. Unknown is not scored.

Threat comes from threat intelligence:

Evidence	Threat
In CISA KEV	1.0, and severity is raised to 10
FIRST EPSS p	0.7 + 0.3 × √p
No data	0.7

A KEV finding in a running container always scores 100. KEV and EPSS only cover CVE IDs, so other advisory IDs, such as GHSA (GitHub Security Advisory), DLA (Debian LTS Advisory), and DSA (Debian Security Advisory), always use 0.7. With threat intelligence off, every finding uses 0.7.

Usage is 1.0 when a running, paused, or restarting container uses the image, 0.8 when only stopped containers do, and 0.5 when none do. If Arcane can’t list containers, usage is 1.0.

Finding	Risk
KEV, running	100
CVSS 9.8, no threat data, running	69
CVSS 7.5, EPSS 36%, running	66
CVSS 7.5, EPSS 36%, stopped	53
CVSS 9.8, EPSS 1%, unused	36

Image score

Only fixable findings count, each CVE once per image at its highest risk. The score weights the top four findings plus a term for the fixable count n:

score = 0.70 × 1st + 0.15 × 2nd + 0.05 × 3rd + 0.02 × 4th + 8 × (1 − e^(−n/40))

The count term adds at most 8 points. For example, 12 fixable findings whose top four score 100, 66, 57, and 36 give 70 + 9.9 + 2.85 + 0.72 + 2.07 ≈ 86.

No fixable findings scores 0; if none can be scored, the score is unavailable. Unrated non-CVE advisories are skipped.

Environment score

The environment score is the average of its scanned images’ scores, weighted by usage: running 3, stopped 2, unused or unknown 1. Images with no fixable findings count as 0. If a running image, or one with unknown usage, has a fixable KEV finding, the score is at least 70.

For example, a running image at 57, a stopped image at 53, and a clean unused image give (57 × 3 + 53 × 2 + 0) / 6 ≈ 46. Scores only include images still on the host with a completed scan, and skip ignored findings.

Combined score

The Security overview pools every environment’s scanned images into one score, weighted by usage the same way as the environment score. A large environment counts for more than a small one. If any environment has a running or unknown-usage image with a fixable KEV finding, the combined score is at least 70.

Risk bands

Score	Band
90–100	Critical
70–89	High
40–69	Medium
1–39	Low
0	None

Settings

Find these under Settings → Security (Vulnerability Scanning and Image Patching); schedules are on the Settings → Automations jobs.

Setting	Purpose
Scheduled Vulnerability Scan	Turn scheduled scans on or off.
Vulnerability Scan Interval	Cron schedule for scans (default 0 0 * * *).
Trivy Config (YAML)	YAML configuration applied to every scan.
.trivyignore	Vulnerability IDs to exclude, one per line.
CPU Limit (cores)	CPU cores per scan container, such as 0.5; 0 for no limit. Hosts using CPU affinity use whole cores.
Memory Limit (MB)	Memory limit per scan container.
Concurrent Scan Containers	Maximum scan containers running at once, across manual and scheduled scans.
Only Report Fixable Vulnerabilities	Only record vulnerabilities that have a known fix.
Use Remote Trivy Server	Scan through a remote Trivy server.
Trivy Server URL	Remote Trivy server URL.
Trivy Server Token	Optional remote Trivy server token.
Threat Intelligence	Fetch CISA KEV and FIRST EPSS data for the risk score (default on).
Patched Image Tag Suffix	Tag suffix for patched images (default patched).
Patch Timeout (seconds)	Timeout for a single patch run (default 600).
Patch All Platforms	Patch every platform of a multi-platform image, not just the server’s own.
Scheduled Image Patching	Turn scheduled patching on or off.
Image Patch Interval	Cron schedule for patching (default 0 3 * * *).