Overview

Multi Arch Support with Scanning introduces support for multi-platform (multi-architecture) container image scanning. Each architecture-specific child image within a multi-platform image is scanned, stored, and displayed independently using its RepoDigest as the unique identifier.

This feature is available as part of the U14 release.

What is changing

Today, scanning is supported only for individual architecture images and does not support images that contain a manifest list (fat manifest) with multiple architectures under the same image name and tag.

With this enhancement:

  • Each architecture-specific child image (for example, amd64 and arm64 variants) is treated as a separate entity
  • Image data is not overwritten across architectures
  • Vulnerability and compliance results are maintained independently per architecture

The feature provides:

  • API support for scanning individual architecture images that belong to a multi-platform image using RepoDigest
  • ScannerCLI support for scanning and registering architecture-specific images using RepoDigest
  • Registry scanning support for automatic scanning of multi-platform images containing manifest lists

Why this change is being made

Container platforms increasingly leverage multi-platform images to support diverse runtime architectures such as linux/amd64, linux/arm64, and others under a single image name and tag.

Since each architecture image has its own unique content, vulnerabilities, and compliance posture, treating the top-level manifest as a single image can result in inaccurate representation and potential data conflicts.

This enhancement enables accurate vulnerability and compliance assessment for each architecture-specific image by using RepoDigest as the immutable and unique identifier across scanning, storage, and display workflows. It also aligns the platform with modern container image distribution practices.

Customer impact

This is a new feature and does not affect existing image scanning workflows for single-architecture images.

Customers scanning multi-platform container images will gain the ability to:

  • Scan individual architecture images using RepoDigest
  • View each architecture-specific image as a separate entry within the platform
  • Maintain unique vulnerability and compliance results for each architecture
  • Avoid image overwrites when multiple architectures share the same image name and tag

Customers should be aware that:

  • Images derived from a multi-platform manifest will be displayed along with their architecture to ensure uniqueness
  • Multiple entries and more data will be visible across the system for what was previously perceived as a single image

Prerequisites

Customers must upgrade all relevant scanning components before utilizing multi-platform image scanning capabilities.

Specifically:

  • Upgrade all ScannerCLI and scanner deployments to versions that support multi-platform image scanning
  • Review internal workflows, automation, or reporting processes that rely on image name and tag uniqueness, and add RepoDigest as the primary identifier for architecture-specific image records if required
  • Before onboarding multi-platform images at scale, validate that downstream integrations and operational processes can accommodate separate entries for each architecture variant

Because scan requests are distributed across available scanners, environments running a mix of upgraded and older scanner versions may experience inconsistent multi-architecture scanning behavior. Older scanners do not support this functionality.

To ensure consistent results, begin using multi-platform image scanning only after all scanners have been upgraded to a supported version.


Frequently Asked Questions

Q: Will single-architecture image scanning change?

A: No. Existing single-architecture scanning workflows are not affected.

Q: Why do I see multiple entries for the same image name and tag?

A: Each architecture variant within a multi-platform manifest is represented independently using RepoDigest to ensure accurate vulnerability and compliance results per architecture.

Q: What identifier should I use in automation?

A: Use RepoDigest as the immutable unique identifier for architecture-specific image records.

Q: Do all scanners need to be upgraded?

A: Yes. Mixed scanner versions can produce inconsistent results for multi-platform image scanning.