### Container Scanning basic features  

Your application’s Docker image may itself be based on Docker images that contain known vulnerabilities. By including an extra Container Scanning job in your pipeline that scans for those vulnerabilities and displays them in a merge request, you can use GitLab to audit your Docker-based apps.  

Different features are available in different GitLab tiers, as shown in the following table:  

Capability | In Free | In Ultimate
-- | -- | --
Configure Scanners | ✓ | ✓
Customize Settings (Variables, Overriding, offline environment support, etc) | ✓ | ✓
View JSON Report as a CI job artifact | ✓ | ✓
Generation of a JSON report of dependencies as a CI job artifact | ✓ | ✓
Ability to enable container scanning via an MR in the GitLab UI | ✓ | ✓
UBI Image Support | ✓ | ✓
Support for Trivy| ✓ | ✓
Support for Grype | ✓ | ✓
Inclusion of GitLab Advisory Database| Limited to the time-delayed content from GitLab advisories-communities project | Yes - all the latest content from Gemnasium DB
Presentation of Report data in Merge Request and Security tab of the CI pipeline job | X | ✓
Interaction with Vulnerabilities such as merge request approvals | X | ✓
Solutions for vulnerabilities (auto-remediation) | X | ✓
Support for the vulnerability allow list | X | ✓
Access to Security Dashboard page| X | ✓
Access to Dependency List page| X | ✓

https://docs.gitlab.com/ee/user/application_security/container_scanning/#capabilities

View JSON Report as a CI job artifact:

![contaner scanning free](./contaner-scanning-free.png)  


Example project using Container Scanning on JiHu GitLab:

[Container Scanning Demo](https://jihulab.com/ultimate-plan/demo/container-scanning-demo/-/tree/4-demo-test-new-policy-name)