A complete guide to GitLab Container Scanning
Mar 5, 2026Fernando Diaz
Summary
This post details the five types of container scanning offered by GitLab: pipeline-based scanning (using Trivy), container scanning for the registry, multi-container scanning (beta), and continuous vulnerability scanning. It explains what each does, its best use cases, tier availability, and how to enable them. It also covers common configurations for pipeline-based scanning, viewing vulnerabilities in merge requests and the vulnerability report, and viewing the dependency list (SBOM).
More from the Security Control Framework trail
- Track organization-wide security risk in one dashboard
- Dependency Firewall: Block risky packages before the build
- Two front doors: Module-level access in a Django GRC app
- How GitLab tracks vulnerabilities through refactors and reformatting
- Shai-Hulud copycat campaign targets Python developers through PyPI typosquatting