Overview of the acrcssc extension
mainThe acrcssc extension for Azure CLI provides continuous patching capabilities for Azure Container Registry (ACR). It automates the scanning and patching of container images to ensure they are up-to-date with the latest security patches.
How it works:
- Scanning: Uses Trivy to scan configured images for vulnerabilities (CVEs).
- Patching: Uses Copacetic to apply patches.
Preview Limitations:
- Windows-based container images are not supported.
- Only "OS-level" vulnerabilities (managed by package managers like
aptoryum) are patched. Application-level vulnerabilities (e.g., Go, Python, NodeJS binaries) cannot be patched. - Patching is only available in Public regions (not Sovereign regions).
- Requires ACR Tasks to be available in the registry/region.