age
Image should be less than expected days old.
21 docs tagged with "rules"
Detailed explanation of rule evaluation and JSON logic.
View all tagscve-count
Max allowed violations for a given severity level.
env-blacklist
Image must not contain forbidden environment variables.
exposed-ports-whitelist
Image exposes permitted ports.
fix-available
All vulnerabilities should be fixed if a patch exists.
has-sbom
Image must provide a Software Bill of Materials.
layers-count
Image has an acceptable number of layers.
license-blocklist
Image must not include components with licenses from the configured blocklist.
max-size
Image size is within limits.
min-score
OpenSSF Scorecard score is above the threshold.
platforms-count
Image should support multiple platforms.
Playbook customisation
Playbooks let you define your own security policies and customise the structure of your reports.
registry-domain-whitelist
Checks if requested image registry domain is in the domains list.
required-labels
Image must have required OCI labels.
Rules
Rules are the evaluation heart of RegiS. Each rule defines a specific condition that the analysis results must satisfy, together with a severity level, interpolated messages, and optional parameters. Rules are grouped and evaluated by playbooks, and their results feed into the overall score.
Rules
This reference lists all built-in rules shipped with RegiS. For a conceptual overview of how rules work, how to override defaults, and how to use rule templates, see Concepts → Rules.
secret-scan
No secrets or credentials should be embedded in the image.
severity-count
Max allowed issues for a given severity level.
severity-count
Max allowed violations for a given severity level.
tag-blacklist
Image tag should not be 'latest'.
user-blacklist
Image must not run as root.