📦Container Images

Manage your organization's container supply chain from end to end: connect registries, automatically tag and label images, inspect image inventories, and map back to source code.

Requires a container registry integration - see Container Integrations.

Automatic Labeling Policy

To ensure every Docker image is traceable back to its Dockerfile and source code repository, configure an Auto-Labeling policy.

Policy definition

1. Go to Admin - Policies, expand Code Risk, then select Rules.

2. Create a new rule with the following configuration:

   • Trigger: Pull Request Created

   • Conditions: Add conditions to limit which repositories, organizations, or products participate. Discuss the scope with affected developers before enabling broadly.

   • Action: Tag all Dockerfiles

3. Under the Tag all Dockerfiles action, enable the following OCI annotations:

   • org.opencontainers.image.source

   • org.opencontainers.image.path

   • (Optional) Add a Custom Message to display in PR comments

4. Give the rule a name, save, and toggle it On.

OCI annotations let you trace each image back to the exact Dockerfile path and Git commit, improving supply chain auditability. See the developer-facing guide: Adding OCI Tags to Docker Images.

Viewing Container Images

Go to Inventory - Container Images to browse all synced images. Click any row to see its recent versions.

Arnica scans the last 20 versions per image each day and marks the most recent as the latest. Versions are sorted in the following order:

1. latest tag - always appears first; if multiple exist, most recently pushed wins

2. Semantic version tags - e.g. 1.2.3, 2.0.0-beta; higher versions rank first; leading v is stripped automatically

3. Date-based tags - e.g. 2025-09-15; newer dates appear first

4. Push time fallback - everything else is sorted by when it was pushed, newest first

Mapping Images to Source Code

Arnica can automatically or manually map images back to their source Dockerfiles.

Automatic mapping

Method	Assignment type	Confidence
Statistical matching - compares image config history against Dockerfile lines in the codebase	Lines	Medium
Label-based matching - uses org.opencontainers.image.source and org.opencontainers.image.path labels	Labels	High

Label-based matching requires the source repositories to be visible to Arnica after a full inventory scan. See Adding OCI Tags to Docker Images for setup.

Manual mapping

In Inventory - Container Images, click an image and select a repository from the Link to repository dropdown. If Arnica detected Dockerfile files in that repository during the last inventory scan, a second dropdown lets you select the specific Dockerfile - useful for monorepos where a Dockerfile lives alongside the app it builds.

To revert to automatic mapping at any time, click the Auto radio button. Changes are saved automatically.