To scan a container image with the Safeguard CLI, pass the image reference to the scan command. It builds an SBOM for the image, matches it against vulnerability data and writes results to an output folder. Private registries need credentials, and the image must be pullable or present locally.
The basic command
safeguard scan --image nginx:1.27
There is also a dedicated command that wraps the same pipeline, and its help text says the output is identical:
safeguard container-scan --image nginx:1.27
Use whichever reads better in your scripts. The scan accepts exactly one target at a time, so an image scan and a directory scan are two separate runs.
What you get back
Results land in a folder per scan, under an output directory that defaults to output. The usage docs name files such as vuln.json, license.json and collection.json. The vulnerability file follows the grype layout, with matches under a data field, which makes it easy to filter with jq.
Change the folder with the output flag:
safeguard scan --image nginx:1.27 --output image-results
Private registries
Pass the registry credentials on the command line, or log in with your container tool first:
safeguard scan --image registry.example.com/team/app:2.4.1 \
--registry-username "$REG_USER" --registry-password "$REG_PASS"
Read the values from environment variables rather than typing them, so they stay out of shell history. In CI, store them as masked secrets.
Pick tags with care
A tag such as latest moves. If you scan app:latest today and again next week, you may be scanning different images. Prefer an immutable tag or a digest for anything you plan to compare over time. Record the reference you scanned next to the results.
Troubleshooting
The troubleshooting page lists two common failures:
- Image not found. The image is not local or the reference is wrong. Check with your container tool, pull it, or use the full registry path.
- Registry authentication failed. Credentials are missing. Run a registry login, or pass the username and password flags.
Large images can also take a while. Add the verbose flag to see progress, and check the log file under ~/.sg/logs if a run stops without a clear message.
What an image scan can and cannot tell you
An image scan lists packages found in the image layers and the known vulnerabilities attached to them. It does not tell you whether your running application calls the vulnerable function. For that you need reachability analysis, which is a separate step. Treat the raw list as an inventory plus a starting point for triage, not a verdict.
You can see the idea in the interactive walkthrough below.
Click through it at your own pace, or open it full screen.
Quick check
Can I scan an image and a directory in one command?
No. The scan command takes exactly one target. Run it once for the image and once for the directory.
Why do two scans of the same tag differ?
Tags can be moved to a new image, and vulnerability data changes over time. Scan by digest and record the date to compare fairly.
Safeguard also offers a free scan at gold.safeguard.sh/scan if you want a quick look before wiring the CLI into a pipeline.
Sources
Last reviewed: 19 October 2026.
