### Problem to solve Container Scanning scans Docker images when they are created during the pipeline. Images are then stored in the GitLab Container Registry, and can be reused by other pipelines and deployment processes as stable images that will land in production. Security status can change at any time even if there are no code changes, for example if an unknown vulnerability is disclosed to the public. Developers and security teams need to know the current security status of the images stored in the GitLab Container Registry. When the advisory database is updated, they need to know when new vulnerabilities apply to existing images. Similarly, they also need to know when new vulnerabilities are introduced when a new image is pushed into the registry. This needs to happen without requiring the users to manually run or schedule a CI pipeline. ### Further details :projector: Video walkthrough of this proposal: https://www.youtube.com/watch?v=pv928PCs3iQ ### Proposal 1. Users who view a specific container image in the registry will see a banner that provides summarized results from the Container Scanning findings. 1. At the project level, summarized dependency results will be displayed for the `latest` tag and a link will be provided to the Dependency List page. 1. At the project level, users will be able to view a list of all packages (discovered dependencies) on the Dependency List page. 1. The current content of the Dependency List page will be grouped under a `Development dependencies` tab. 1. Dependencies will be displayed in a new `Container registry dependencies` tab. 1. The `Container registry dependencies` tab will support filtering by `Image`. **Note:** As this is an MVC, users will only be able to view vulnerabilities for the `latest` tag. Support for all tags is planned in a future iteration. ### What does success look like, and how can we measure that? <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> *This page may contain information related to upcoming products, features and functionality. It is important to note that the information presented is for informational purposes only, so please do not rely on the information for purchasing or planning purposes. Just like with all projects, the items mentioned on the page are subject to change or delay, and the development, release, and timing of any products, features, or functionality remain at the sole discretion of GitLab Inc.* <!-- triage-serverless v3 PLEASE DO NOT REMOVE THIS SECTION --> ### Design | Container registry page | Improved banner (use this mock) | | ------ | ------ | | |  | | Dependency list | | ------ | | |