Scaleway registry

Note

Included in the Pro and Business plans. On other plans, the CLI stops before scanning and the API refuses the upload (402).

Scaleway Container Registry does not scan images. checkops scaleway sync lists recently pushed tags through the Scaleway API, scans each image with Trivy and sends the result to CheckOps.

• Product: prefix + image name (front/web becomes front-web).
• Application: the registry namespace (or --app).
• Version: the tag. latest becomes latest-<digest prefix>.

The same content pushed under several tags is scanned once. Nothing is kept between runs: each run picks the tags pushed within --since-hours (25 h by default).

Permissions

An API key of an IAM application with only the ContainerRegistryReadOnly permission set on the project is enough. It lists images and, as a password, pulls them (user nologin). It is never sent to CheckOps.

Scheduled job with Terraform

The Terraform / OpenTofu module creates the IAM application, its key, two Secret Manager secrets and a Serverless Jobs job that runs every day at 3 am:

module "checkops" {
  source         = "./checkops"
  project_id     = "11111111-1111-1111-1111-111111111111"
  checkops_token = var.checkops_token
  # namespaces   = "prod,staging"
  # schedule     = "0 3 * * *"
}

To send existing images, run the job once from the console with the arguments scaleway sync --all.

The image variable defaults to a versioned tag (cli:<version>-trivy); pin it by digest (…-trivy@sha256:…) to control exactly what runs.

Caution

The Terraform state contains the CheckOps token and the Scaleway secret key in clear text. Keep it in an encrypted remote backend with restricted access, never in a Git repository or on a laptop.

Without Terraform

The registry.gitlab.com/clearcloud.fr/check-ops/cli:trivy image contains the CLI and Trivy:

docker run --rm \
  -e SCW_SECRET_KEY -e CHECKOPS_TOKEN \
  -e SCW_DEFAULT_PROJECT_ID=11111111-1111-1111-1111-111111111111 \
  registry.gitlab.com/clearcloud.fr/check-ops/cli:trivy \
  checkops scaleway sync --since-hours 25

Start with --dry-run to see the selected images without scanning or sending anything.

Options

Option	Variable	Default	Purpose
--region	SCW_DEFAULT_REGION	fr-par	Regions, comma-separated.
--project-id	SCW_DEFAULT_PROJECT_ID	—	Limit to one project.
--namespace	CHECKOPS_SCW_NAMESPACE	all	Namespaces to follow.
--prefix	CHECKOPS_PRODUCT_PREFIX	—	Product prefix.
--app	CHECKOPS_APP	namespace	Application to attach products to.
--since-hours	—	25	Tags pushed within this delay.
--all	—	—	Ignore the delay (first run).
--tags-per-image	—	1	Maximum tags scanned per image.
--secrets	—	—	Also look for exposed secrets (Pro and Business plans).
--trivy	TRIVY_BIN	trivy	Trivy command.
--dry-run	—	—	List without scanning.
--scw-secret-key	SCW_SECRET_KEY	—	Scaleway key (required).

Exit code 1 if an image could not be scanned or sent; the others are still sent.