Container Configuration

Overview

Container hardening findings are produced by Software Composition Analysis (SCA) and configured from the Nullify dashboard — there is no checked-in config file. Query findings with GET /sca/containers/findings; fetch a single finding with GET /sca/containers/findings/{findingId}, and update one with PATCH /sca/containers/findings/{findingId}.

SBOM

Retrieve the software bill of materials for a repository's container images from the Context Engine:

GET /context/sboms

Ignore findings

Suppress a container finding by allowlisting it per-finding from the dashboard or via the API:

POST /sca/containers/findings/{findingId}/allowlist

Request body:

{
  "allowlistReason": "Base image patched in next release",
  "allowlistType": "UserAssumeRisk"
}

allowlistType is one of AI, UserFixed, UserAssumeRisk, UserFalsePositive, or UserOther. Dependency findings are configured separately — see Configuration – Dependencies.

Autofix and private images

Container remediation can propose base-image or dependency changes where enough repository and build context is available. Review the generated diff and rebuild the image to verify the result. Dependency Analysis API lists the container finding lifecycle and autofix operations.

An image reference alone does not grant access to a private registry. Use the supported cloud/container access arrangement for your tenant; the private package registry connectors document package resolution and should not be assumed to configure every container registry.