#### Product
  #### Use Cases
  ")
  ###### 4-Minute Video
  ##### What is Deepfactor and How Does It Work? >
  + 
  #### Resources
  ###### Next-Gen AppSec Series
  ##### Next-Gen AppSec Series—Deepfactor SCA: 80% Less Noise, 50% Lower Cost >
Deepfactor is now
part of Cisco
|
[Learn
more
  #### Product
  [###### 4-Minute Video
  [###### Whitepaper
  ##### Implement Effective Next-Gen Container Runtime Security in Kubernetes and Cloud Native Apps >
Deepfactor's Application Security Platform will no longer be offered for sale or renewal effective September 20, 2024.
## Getting Started
## Tutorials
* SBOM & SCA
  + Scan container images in K8s cluster
    - 
* Runtime Security
  + Kubernetes workload
  + Containers/Other orchestration platforms
  + Non-containerized workloads
## Deepfactor Platform
* Insights Knowledge Base
* Knowledge Base
* FAQs
## Integrations
## Self managed Deepfactor portal
* Install Self managed Deepfactor portal
  + Kubernetes Cluster
    - Customizing Deepfactor portal deployment
      * 
  + AWS EC2
  + VMWare vSphere
* Manage Deepfactor Portal
* Deepfactor Portal Certificate
## Release Notes
# Scanning container images from private registries using Deepfactor CLI
Deepfactor static scan utility provides the capability of scanning images in private registries. In order to scan images from private registries, Deepfactor scanner needs to authenticate with the registry. You can provide registry credentials using environment variables to the Deepfactor scanner. The following section will describe the environment variables that need to be set for different types of private registries.
### Private registries with basic authentication support (Ex. Docker Hub registry) 
If you are trying to scan container images hosted in private registries that support basic authentication, please set the following environment variables on the terminal before initiating the scan using the dfctl scan command
* REGISTRY\_USERNAME
* REGISTRY\_PASSWORD
Usage:
```
export REGISTRY_USERNAME=DOCKER_REGISTRY_USERNAME
export REGISTRY_PASSWORD=DOCKER_REGISTRY_PASSWORD
### Amazon Elastic Container Registry (Amazon ECR) 
Deepfactor scanner uses AWS SDK internally and you don’t need to install aws CLI tool. If you are trying to scan container images hosted in Amazon Elastic Container Registry (Amazon ECR), then you will need to export the following environment variables before initiating the scan.
* AWS\_ACCESS\_KEY\_ID
* AWS\_SECRET\_ACCESS\_KEY
* AWS\_DEFAULT\_REGION
Please refer to the following AWS article for more details
**Note:** Please ensure you unset REGISTRY\_USERNAME environment variable before starting the scan.
unset REGISTRY_USERNAME
### Google Container Registry (GCR) 
Deepfactor scanner uses Google Cloud SDK and you don’t need to install gcloud command. In order to authenticate with GCR, you will need to provide a credential file which must have the roles/storage.objectViewer permission.
Please refer to the following Google cloud document for more details
Please set the path of the credentials file in the following environment variable.
* GOOGLE\_APPLICATION\_CREDENTIALS
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/credential.json
### Azure Container Registry (ACR) 
Deepfactor scanner uses Azure SDK internally and you don’t need to install az command. Please ensure the service principal exported has the `AcrPull` permission. You will need to set the following environment variables before initiating the scan
* AZURE\_CLIENT\_ID
* AZURE\_CLIENT\_SECRET
* AZURE\_TENANT\_ID
Example Usage:
Create the service principal
export SP_DATA=$(az ad sp create-for-rbac --name DFScan --role AcrPull --scope "/subscriptions//resourceGroups//providers/Microsoft.ContainerRegistry/registries/")
Set client id, secret and tenant environment variables
export AZURE_CLIENT_ID$(echo $SP_DATA | jq -r .appId)
export AZURE_CLIENT_SECRET$(echo $SP_DATA | jq -r .password)
export AZURE_TENANT_ID$(echo $SP_DATA | jq -r .tenant)
Run the scan using dfctl
dfctl scan IMAGE_NAME
##### Was this article helpful?
## How can we help?
Name: \*
Email: \*
Message: \*
Updated on May 30, 2023
Table of Contents
Deepfactor is a next-gen application security platform, using static container scan data + runtime analysis to prioritize vulnerabilities to those representing true risk to a business—based on reachability, runtime usage, deployment context, and exploit maturity.
**SUBSCRIBE TO OUR NEWSLETTER!**
© 2025 Deepfactor, Inc. All Rights Reserved.
 |  |
  [###### Next-Gen AppSec Series
# Scanning images from private registries in K8s cluster using Deepfactor
Deepfactor can deploy a scan pod in your K8s cluster which will scan container images used by pods launched in your K8s cluster. In order for this scan pod to access and scan container images, you will need to specify registry credentials as a K8s secret. The following table provides link to the appropriate guide for different registries.
| Registry | Documentation Link |
| --- | --- |
| AWS Elastic Container Registry (ECR) using EKS on EC2 |  |
| AWS Elastic Container Registry (ECR) using EKS on AWS Fargate |  |
| Azure Container Registry |  |
| Google Container Registry |  |
| Harbor |  |
| Docker Hub Container Registry |  |
| Docker Trusted Registry (DTR) – Cloud & on-premise |  |
| JFrog (Cloud & On-Prem) |  |
| Nexus |  |
| Other  or  compliant registries |  |
### Token expiration 
Some registries allow you to create tokens which you can use for authentication. If you are using a token with an expiration time, please note that, before the token expires, you will need to update the K8s secret passed to Deepfactor scan pod with the new token to ensure it can continue to pull and scan images from your private registry.