age
Image should be less than expected days old.
21 docs tagged with "rules"
Detailed explanation of rule evaluation and JSON logic.
View all tagscve-count
Max allowed violations for a given severity level.
env-blacklist
Image must not contain forbidden environment variables.
exposed-ports-whitelist
Image exposes permitted ports.
fix-available
All vulnerabilities should be fixed if a patch exists.
has-sbom
Image must provide a Software Bill of Materials.
layers-count
Image has an acceptable number of layers.
license-blocklist
Image must not include components with licenses from the configured blocklist.
max-size
Image size is within limits.
min-score
OpenSSF Scorecard score is above the threshold.
platforms-count
Image should support multiple platforms.
Playbook Customisation
Playbooks allow you to define your own security policies and customize the structure of your reports. While the Default Playbook covers many best practices, you may want to create a custom one tailored to your organization's specific needs.
registry-domain-whitelist
Checks if requested image registry domain is in the domains list.
required-labels
Image must have required OCI labels.
Rules
Rules are the evaluation heart of RegiS. Each rule defines a specific condition that the analysis results must satisfy, together with a severity level, interpolated messages, and optional parameters.
Rules
This reference lists all built-in rules shipped with RegiS. For a conceptual overview of how rules work, how to override defaults, and how to use rule templates, see Concepts → Rules.
secret-scan
No secrets or credentials should be embedded in the image.
severity-count
Max allowed issues for a given severity level.
severity-count
Max allowed violations for a given severity level.
tag-blacklist
Image tag should not be 'latest'.
user-blacklist
Image must not run as root.