age
Image should be less than expected days old.
25 docs tagged with "rules"
Detailed explanation of rule evaluation and JSON logic.
View all tagscve-count
Max allowed violations for a given severity level.
env-blacklist
Image must not contain forbidden environment variables.
exposed-ports-whitelist
Image exposes permitted ports.
fix-available
All vulnerabilities should be fixed if a patch exists.
has-sbom
Image must provide a Software Bill of Materials.
layers-count
Image has an acceptable number of layers.
license-blocklist
Image must not include components with licenses from the configured blocklist.
max-size
Image size is within limits.
min-score
OpenSSF Scorecard score is above the threshold.
platforms-blacklist
Image must not support forbidden platforms.
platforms-count
Image should support multiple platforms.
platforms-required
Image must support a required set of platforms.
platforms-whitelist
Image must only support allowed platforms.
Playbook customisation
Playbooks let you define your own security policies and customise the structure of your reports.
registry-domain-whitelist
Checks if requested image registry domain is in the domains list.
required-labels
Image must have required OCI labels.
Rules
This reference lists all built-in criteria shipped with Regis. For a conceptual overview of how rules and criteria work, how to override defaults, and how to bind a criterion, see Concepts → Rules and criteria.
Rules and criteria
Rules are the evaluation heart of Regis. A rule is the policy decision your
secret-scan
No secrets or credentials should be embedded in the image.
severity-count
Max allowed issues for a given severity level.
severity-count
Max allowed violations for a given severity level.
tag-blacklist
Image tag should not be 'latest'.
user-blacklist
Image must not run as root.
verified-secrets
No verified, active credentials should be embedded in the image.