Security Center:Add image repositories to Security Center

Background information

You can add the following types of image repositories to Security Center: image repositories of Container Registry, Harbor repositories, and Quay repositories. Harbor repositories and Quay repositories are third-party image repositories.

Prerequisites

The feature of container image scan is enabled. For more information, see Enable container image scan.

Add an image repository of Container Registry to Security Center

Container Registry has Enterprise Edition and Personal Edition. You can synchronize the information about the images in the image repositories of both Container Registry Enterprise Edition and Container Registry Personal Edition to Security Center. However, Security Center can scan the images only of Container Registry Enterprise Edition. You can add image repositories of an Container Registry Enterprise Edition instance to Security Center after you configure access to the instance over a virtual private cloud (VPC). For more information, see Configure access over VPCs.

Add a third-party image repository to Security Center

If your third-party image repository is deployed on a hybrid cloud that is composed of VPCs and data centers, you must configure traffic forwarding rules and then add the image repository to Security Center. For more information, see Configure traffic forwarding rules and add image repositories deployed on hybrid clouds.

If you create an access control policy for your image repository, make sure that the access control policy allows access from the IP address pools in the region in which the image repository resides.

1. Log on to the Security Center console. In the left-side navigation pane, choose Assets > Container.
2. On the Container page, click the Image tab and click Integrate.
3. In the Integrate image repository panel, configure the following parameters and click Next.

   Parameter	Description
   Private repository type	The type of the third-party image repository. Valid values: harbor and quay. Note Specify the value of Private repository type based on the type of your image repository.
   Version	The version of the third-party image repository. Valid values: V1: If the version of the image repository is 1.X.X, select this option. V2: If the version of the image repository is 2.X.X or later, select this option.
   Communication Type	The protocol that you want Security Center to use to communicate with the third-party image repository.
   Network Type	The network type of the third-party image repository.
   RegionId	The ID of the region in which the third-party image repository resides.
   IP	The IP address of the third-party image repository. Note If the third-party image repository is deployed on a hybrid cloud, you must configure the IP parameter.
   Domain	The domain name of the third-party image repository.
   Speed limit	The number of images that can be added to Security Center per hour. Default value: 10. Important If you add a large number of images per hour, your services may be adversely affected. In most cases, we recommend that you do not set this parameter to Unlimited.
   Username	The username used to access the third-party image repository.
   Password	The password used to access the third-party image repository.

   After the third-party image repository is added to Security Center, you can click Scan Settings on the Image Security page to view the information about the added image repository in the panel that appears.

Configure traffic forwarding rules and add image repositories deployed on hybrid clouds

If your third-party image repository is deployed on a hybrid cloud that is composed of VPCs and data centers, you must configure traffic forwarding rules and then add the image repository to Security Center. To configure traffic forwarding rules and add the image repository to Security Center, perform the following steps:

1. Specify an Elastic Compute Service (ECS) instance and configure traffic forwarding rules to forward the traffic destined for the ECS instance to an on-premises server on which the third-party image repository resides.

   In the following command examples, the traffic on Port A of the ECS instance is forwarded to Port B of the on-premises server that uses the IP address of 192.168.XX.XX.

   • Command examples for CentOS 7
     • Use firewall-cmd

       firewall-cmd --permanent --add-forward-port=port=<Port A>:proto=tcp:toaddr=<192.168.XX.XX>:toport=<Port B>

     • Use iptables:
       1. Enable port forwarding.

          echo "1" > /proc/sys/net/ipv4/ip_forward                                                                                                                                                                                                                                                                                                                                                                                                                                                                           

       2. Configure port forwarding.

          iptables -t nat -A PREROUTING -p tcp --dport <Port A> -j DNAT --to-destination <192.168.XX.XX>:<Port B>

   • Command example for Windows

     netsh interface portproxy add v4tov4 listenport=<Port A> listenaddress=* connectaddress=<192.168.XX.XX> connectport=<Port B> protocol=tcp

2. Add the third-party image repository to Security Center.

   Make sure that you set IP to the address of the ECS instance for which you configured forwarding rules. For more information, see Add a third-party image repository to Security Center.

Error codes