Check container image eligibility before interpreting a missing vulnerability assessment

Source facts

Microsoft lists Docker V2 and Open Container Initiative image formats as supported for container vulnerability assessment. The same matrix excludes super-minimal images such as Docker scratch, public repositories and manifest lists. Microsoft Learn.

Applicability

Apply this eligibility check to Defender for Containers image vulnerability assessment. Record the registry, exact image reference and image format before investigating a missing result or deciding whether the image may be released.

DSE recommendation

DSE recommends making assessment eligibility a recorded prerequisite in the image approval workflow. Compare the submitted artifact with the documented format and repository limits, then assign a separate review path for anything outside that coverage. Ask the image owner to explain how required vulnerability evidence will be obtained before approving an exception. Avoid converting absence of a result into a clean assessment.

Verification

Select an approved representative image and trace its immutable reference through the registry and assessment record. Where a manifest list is involved, identify the specific artifact being evaluated rather than assuming the list itself was scanned. Retain the eligibility decision and observed assessment coverage with the release record. Escalate an unsupported case to the security owner without claiming that the documented service checked it.

Official references

Microsoft Learn: Containers support matrix in Defender for Cloud. Source reviewed September 17, 2026.