Safeguard scan accepts exactly one target, and an image reference is one of them. Run it after the image is built and pushed or loaded, write the output to a folder, and archive that folder. Registry credentials can be passed with dedicated options for private images.
The command
The usage page says scan takes exactly one target: a directory, an image, a repository or an SBOM. For an image:
safeguard scan --image registry.example.com/team/app:build-1234 --output out/
It builds an SBOM for the image and matches it against vulnerability data. The output folder holds the SBOM and per component files such as vulnerability and license results.
The usage page lists options for registry authentication, a username and password pair, and a Git token for repositories. Feed these from your CI secret store, never from the YAML file.
Where in the pipeline
Scan the image that you will ship, by digest if you can, not a stale tag. Scanning the source tree finds the dependencies you declared. Scanning the image also finds operating system packages and anything the build copied in.
A typical order is build, scan, then push to the release registry only if your gate passes. Because the CLI does not fail on findings, the gate is a platform policy or your own check on the result file, as in the gate post.
Prerequisites
Scan needs syft and grype available on the runner, so install them or set the tools directory variable. Check that post if the exit code is 2.
What patch-image is
The CLI also has a command that rebuilds a container image with patched layers. The CLI site describes it, and the usage page does not give its flags, so read the help output before using it. Treat a rebuilt image like any other build output: scan it again and test it before it goes anywhere near production.
Image scanning limits
A scan sees what is in the image, not how it is deployed. A vulnerable package that the running process never loads is still reported unless a reachability check says otherwise. A fixed image tag can also be rebuilt later with different contents, which is why scanning by digest is better.
Multi stage builds
If your build is multi stage, scan the final image, not the builder stage, since only the final one ships. Also scan the base image on its own on a schedule, because new advisories against it appear after your build finished. A rebuild with a refreshed base is often the whole fix.
Quick check
Can I scan an image and a directory in one command?
No. Scan takes one target per run, so use two steps.
Do I need to be logged in to a registry?
For private images, yes. Pass credentials with the registry options from your secret store.
Sources
Last reviewed: 19 October 2026.
