Sonatype Container Scanner

Spec sheet

Headquarters

Sonatype lists its headquarters at 8161 Maple Lawn Blvd #250, Fulton, Maryland 20759, United States.Read 9 Oct 2026 · sonatype.com

Founded

Sonatype's company timeline says it began in 2001 as a project by core contributors to Apache Maven.Read 9 Oct 2026 · sonatype.com

Build-time scanning

Sonatype Container Security scans container images for known vulnerabilities and enforces security policies before images are pushed or deployed.Read 9 Oct 2026 · help.sonatype.com

CI integrations

Supported CI integrations listed for the scanner include Jenkins, GitHub Actions, GitLab, Azure DevOps, and Bamboo.Read 9 Oct 2026 · help.sonatype.com

Detection

Container scanning analyzes operating system packages and application dependencies using Sonatype vulnerability intelligence.Read 9 Oct 2026 · help.sonatype.com

Image registry and orchestration ecosystem

The container security page lists Docker, Kubernetes, OpenShift, Rancher, Amazon ECS/EKS, GKE, AKS, IBM Cloud, and OKE among supported platforms.Read 9 Oct 2026 · sonatype.com

Legacy scanner status

Support for the NeuVector-based scanner ended September 30, 2026, and it is retained only for contractual compatibility without support.Read 9 Oct 2026 · help.sonatype.com

OCI support

Sonatype supports scanning OCI-compliant container images.Read 9 Oct 2026 · help.sonatype.com

OS package coverage

Advanced Container Scanning supports APK, RPM/DNF, and APT package databases, while scanning Windows-based container images is not supported.Read 9 Oct 2026 · help.sonatype.com

Product purpose

Sonatype says its container security offerings scan images, identify risk, and enforce policies across the software development lifecycle.Read 9 Oct 2026 · sonatype.com

Remote images

The scanner can scan remote images without a running Docker daemon and eliminates the need for Docker-in-Docker.Read 9 Oct 2026 · help.sonatype.com

Requirements

The scanner requires IQ Server 1.196.0 or later and IQ CLI 2.6.0 or later; the macOS IQ CLI bundle is not yet supported.Read 9 Oct 2026 · help.sonatype.com

Scanner availability

Starting with IQ Server 1.196.0, Sonatype Container Scanner is the default container scanner in IQ CLI and supported CI integrations.Read 9 Oct 2026 · help.sonatype.com

Trust and compliance

Sonatype's Trust Center lists SOC 2, ISO 27001:2022, and NIST CSF 2.0 among its compliance programs.Read 9 Oct 2026 · trust.sonatype.com

Plans and prices

Every Sonatype Container Scanner plan and price →

Where Specifiction places it

• Container Image Scanning Tools#17 of 297.1