Skip to main content
Incremental container scanning compares a new scan of a container image against an earlier baseline scan, so you can see what changed between two builds instead of rereading the image’s entire finding set each time. The baseline is normally the project’s main-context scan of an image, and the target is a scan of a newer build of that image. Every container scan reports the full set of findings for an image, and consecutive builds share almost all of their contents. Without a comparison, each new scan repeats hundreds of findings already reported on the previous build, and the findings the build actually introduced are hard to pick out. Incremental container scanning reports three sets of findings:
  • Introduced: Findings present on the target scan but absent on the baseline scan. These are the findings the build added.
  • Fixed: Findings present on the baseline scan but gone on the target scan. These are the findings the build resolved.
  • Common: Findings present on both scans. These are the findings the build inherited from the baseline.
You can run the comparison at scan time, as part of endorctl container scan, or later against two existing scans with endorctl container diff. You can also suppress the common findings on the target scan, so a reviewer sees only the findings the build introduced.

​
Compare findings between scans

Run the comparison in one of two ways, depending on whether the scans already exist.

​
At scan time

Use endorctl container scan --diff to scan a build and print the finding delta against the baseline as soon as the scan completes.
  1. Scan the baseline image as a regular scan. Without --as-ref, the scan becomes the project’s main-context baseline.
  2. Scan the target build with --as-ref --diff. Endor Labs scans the image, then prints the findings introduced, fixed, and common relative to the baseline.
    To also suppress the common findings on the target scan, add --suppress-baseline-findings. See Suppress baseline findings for details.
The --diff flag requires --as-ref, because a main-context scan is its own baseline. It is not supported with --dry-run.

​
From two existing scans

Use endorctl container diff to compare findings from two container scans that already exist on the platform. It reads the findings from both scans and reports the difference. By default the command compares the target against the project’s main-context scan of the same image repository. To compare against a specific baseline, set a baseline selector.
You select the target and the baseline separately, each with its own flag. You can compare any two scanned images to see what changed between them. Use the following flags to select the target and baseline scans: See container for the full list of endorctl container diff flags.

​
Suppress baseline findings

Comparing scans shows you what changed, but the common findings still clutter the build’s results. You can suppress those common findings on the target scan, so reviewers see only the findings the build introduced. This is optional, deletes nothing, and you can undo it at any time. To suppress the common findings, add --suppress-baseline-findings to endorctl container scan --diff or endorctl container diff.

​
View suppressed findings in the Endor Labs user interface

Suppressed findings are not deleted. They stay visible and carry the reason Present in Baseline, which shows that the finding came from the baseline and wasn’t introduced by the build. When a new vulnerability later shows up in a package that both scans share, Endor Labs suppresses it on the target scan automatically at the next full scan. To view the suppressed findings:
  1. Select Findings from the left sidebar.
  2. Select the Dismissed filter, then choose Yes.
  3. Under Reason, select Present in Baseline.
Endor Labs shows suppressed findings, labeled with the Present in Baseline reason. See Dismiss findings for more information. To restore the full set of findings, run the comparison again with --release-baseline-findings. This returns the scan to a regular scan with every finding visible again.

​
Examples

The following examples show common ways to run endorctl container diff.
Use this to compare an exact target and baseline pair and limit the report to vulnerability findings.
Use this for a quick, count-only view of what changed. Set --top 0 to show only the counts for each set, grouped by severity.
Use this to feed the comparison into scripts or other tools. The output includes the introduced, fixed, and common findings as structured JSON.
Use this to compare against the auto-resolved baseline and hide the shared findings in one step.

​
Limitations

Incremental container scanning has the following limitations:
  • You can suppress findings only when the baseline is a main-context scan and the target is a reference-context scan from the same image repository.
  • You can’t suppress findings on CI run scans, because CI run data is deleted after roughly 22 days.