Alright folks, I've noticed a few threads popping up recently with questions about container scanning in Cloud One. It's a powerful feature, but the initial setup can trip you up if you're coming from a pure CLI background. Let's get this pinned down.
For those getting started, the first step is to ensure you have the "Container Security" module added to your Cloud One environment. You can't scan what you can't see. Once that's active, you'll need to generate an API key specifically for Container Security—don't reuse your general Trend Micro key. The permissions matter.
Now, for the CLI tips. You'll primarily work with two tools: the `trendmicro` CLI for general management and the `dscli` (Deep Security CLI) for image scanning commands. Make sure both are authenticated with that Container Security API key. A common pitfall I see is users trying to use `docker scan` directly without first pushing the image to a registry that Cloud One is monitoring, or using the `dscli` to scan a local image file. Which route are you planning to use?
If you're integrating this into a CI/CD pipeline, you'll want to look at the `dscli image scan` command. It returns a JSON output you can parse for vulnerabilities. The key is setting the failure thresholds correctly—don't just block on any "info" level finding. Be specific about severity and CVE scores in your pipeline policy.
Share your workflow and any error messages you're hitting. We'll keep it constructive and avoid the "just read the docs" non-answers. Let's build a clear guide here.
Be excellent to each other
Good point on needing the separate Container Security API key. That's a step a lot of guides gloss over.
But I'm skeptical about the pipeline integration being that straightforward. The JSON output from `dscli image scan` is fine, but the real gap is defining a meaningful pass/fail gate. A list of 200 low-severity CVEs isn't helpful. You'll need to write custom logic to filter by severity, fix availability, and maybe ignore known, accepted risks. That's where most teams I've seen hit a wall.
Are you actually blocking builds based on this, or is it just another report no one acts on?
Lisa M.
Thanks, that's super helpful. I was definitely mixing up the CLI tools.
> A common pitfall I see is users trying to use `docker scan` directly without first pushing the image to a registry
Yep, that was my exact next step. So the `dscli` can scan a local .tar file, but it still needs to talk back to Cloud One, right? Just confirming it doesn't do any analysis offline.
For the CI/CD bit, you mentioned `dscli image scan` returns JSON. Is that a full report with all the CVE details, or just a pass/fail status? Wondering how big that payload gets.
CloudNewbie
Spot on about the separate API key, that one gets me every time. The `trendmicro` CLI handles account-level stuff, but `dscli` is the workhorse for scans.
For the CI/CD integration, the JSON output is the full report. It includes all CVE details, which can get massive. I pipe it to `jq` right away to filter for severity and maybe package name. Trying to parse the raw blob in a pipeline script is a headache.