anchorectl image

Image related operations.

Every command on this page also accepts the global flags.

Subcommands

image add — Analyze a container image
image ancestors — List analyzed ancestor images, which are the images that form the base layers of the image
image check — Get the policy evaluation for the given image
image content — Get image content
image delete — Delete an image analysis
image get — Get information about a single image
image list — List all images visible to the user
image metadata — Get image metadata
image one-time-scan — Analyze a container image
image sbom — Get image SBOM in the native Anchore format
image vulnerabilities — Get image vulnerabilities

image add

Analyze a container image.

anchorectl image add IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The container image to analyze (e.g. docker.io/library/nginx:latest).

Examples

# Submit image for addition to Anchore Enterprise (Anchore Enterprise will pull
# image from registry and perform full analysis)

anchorectl image add ghcr.io/place/thing:v0.1.0

# Submit image for addition to Anchore Enterprise (anchorectl will perform full
# local image analysis, SBOM + additional analysis pushed to Anchore Enterprise)

anchorectl image add ghcr.io/place/thing:v0.1.0 --from docker

# Submit image for addition to Anchore Enterprise (anchorectl will perform full
# local image analysis from a local podman daemon image, SBOM + additional
# analysis pushed to Anchore Enterprise; falls back to the registry if the image
# is not present in the local podman daemon)

anchorectl image add ghcr.io/place/thing:v0.1.0 --from podman

# Submit image for addition to Anchore Enterprise (use SBOM generated by Syft,
# no additional analysis performed, and push to Anchore Enterprise)

syft -o json ghcr.io/place/thing:v0.1.0 | anchorectl image add ghcr.io/place/thing:v0.1.0 --from -

# Submit and wait for analysis to complete

anchorectl image add ghcr.io/place/thing:v0.1.0 --wait

# Submit and get results once analysis is completed

anchorectl image add ghcr.io/place/thing:v0.1.0 --get content,vulnerabilities=/path/to/vulns.json

# Submit and fetch all results to a directory

anchorectl image add ghcr.io/place/thing:v0.1.0 --get all=/path/to/dir

# Submit image for addition to Anchore Enterprise and perform a STIG evaluation locally

anchorectl image add ghcr.io/place/thing:v0.1.0 --stig --stig-profile /path/to/profile --stig-input-file /path/to/inputfile

# Associate the added image with an app version (preferred v6 path; the
# --application/-a flag on this command is deprecated and will be removed
# in a future release)

anchorectl app version asset add container-image-remote ghcr.io/place/thing:v0.1.0 --app myapp --version v3.1.4 --asset thing

Flags

Flag	Type	Environment variable	Default	Required	Description
`--annotation`	string (repeatable)	`ANCHORECTL_IMAGE_ANNOTATION`	`[]`	No	One or more key-value annotations to add on the image in Anchore Enterprise (format: key=value).
`-a`, `--application`	string	`ANCHORECTL_APPLICATION`	`""`	No	Deprecated. Associate the image with an application at a specific version in the format `app@version` (example: [email protected]); use `anchorectl app version asset add container-image-remote` instead.
`-d`, `--dockerfile`	string	`ANCHORECTL_IMAGE_DOCKERFILE`	`""`	No	Path to the Dockerfile for this image.
`-f`, `--force`	bool	`ANCHORECTL_FORCE`	`false`	No	Re-analyze the image even if it has already been analyzed.
`--from`	string	`ANCHORECTL_IMAGE_FROM`	`""`	No	Analyze from the given source (default: `""`, indicating that Anchore Enterprise will pull the image from the registry; allowable-values: `<path-to-syft-SBOM>`, `-`, `docker`, `podman`, `registry`, `docker-archive`) (docker and podman: if the image is not present in the daemon it is pulled from the registry).
`-g`, `--get`	string (repeatable)	`ANCHORECTL_IMAGE_GET`	`[]`	No	Get results and optionally write the raw results to a file (example: `content` or `content=./path/to/file.json` or `all=/path/to/dir`; allowable-keys: `image-metadata`, `sbom`, `sbomspdx`, `sbomcyclonedx`, `content`, `vulnerability`, `policy-evaluation`, `all`).
`-n`, `--no-auto-subscribe`	bool	`ANCHORECTL_IMAGE_NO_AUTO_SUBSCRIBE`	`false`	No	Do not automatically scan newly pushed tags to the registry for the given image.
`-p`, `--platform`	string	`ANCHORECTL_IMAGE_PLATFORM`	`""`	No	An optional platform specifier for use with `--from registry` target type (e.g. `linux/arm64`, `linux/arm64/v8`, `arm64`, `linux`).
`--stig`	bool	`ANCHORECTL_STIG`	`false`	No	Perform a STIG evaluation on the image.
`--stig-container-manual-override`	string	`ANCHORECTL_STIG_CONTAINER_MANUAL_OVERRIDE`	`""`	No	Docker container ID to use as the STIG target (skips creating container with anchore-keep-alive binary).
`--stig-input-file`	string (repeatable)	`ANCHORECTL_STIG_INPUT_FILE`	`[]`	No	Path to input file to use for STIG generation (optional).
`--stig-output-dir`	string	`ANCHORECTL_STIG_OUTPUT_DIR`	`""`	No	Path to save the STIG evaluation (optional).
`--stig-profile`	string	`ANCHORECTL_STIG_PROFILE`	`""`	No	Path to STIG profile (required when `--stig` is set).
`--stig-tools-binary-path`	string	`ANCHORECTL_STIG_TOOLS_BINARY_PATH`	`""`	No	Path to the statically-linked busybox binary inside the tools image (default: /bin/busybox).
`--stig-tools-image`	string	`ANCHORECTL_STIG_TOOLS_IMAGE`	`""`	No	Container image containing a statically-linked busybox binary for shell-less image support (e.g. docker.io/library/busybox:musl). The binary must be statically linked to work in distroless containers.
`--stig-waiver-file`	string (repeatable)	`ANCHORECTL_STIG_WAIVER_FILE`	`[]`	No	Path to waiver file to use for STIG generation. The waiver file can waive controls and dictate the running and/or reporting of those controls (optional).
`-w`, `--wait`	bool	`ANCHORECTL_IMAGE_WAIT`	`false`	No	Wait for the analysis to complete.

image ancestors

List analyzed ancestor images, which are the images that form the base layers of the image.

anchorectl image ancestors IMAGE [flags]

Aliases: ancestor

Arguments

Argument	Description
`IMAGE`	The image to fetch the ancestors for (can be a digest, id, or registry/repo:tag).

Flags

Flag	Type	Environment variable	Default	Required	Description
`-b`, `--base`	bool	`ANCHORECTL_ANCESTOR_BASE`	`false`	No	Only show the analyzed ancestor image with the fewest layers.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `id`. See Output Formats.
`-p`, `--parent`	bool	`ANCHORECTL_ANCESTOR_PARENT`	`false`	No	Only show the analyzed ancestor image with the most layers.

image check

Get the policy evaluation for the given image.

anchorectl image check IMAGE [flags]

Aliases: evaluate

Arguments

Argument	Description
`IMAGE`	The image to fetch the policy evaluation for (can be a digest, id or registry/repo:tag). If supplying a digest or image id, a tag must be supplied with the `-t` flag.

Examples

# Evaluate the active policy against an image
anchorectl image check registry.example.com/my-service:1.4.0

# Show every failing gate, and exit 1 when the evaluation result is fail
anchorectl image check registry.example.com/my-service:1.4.0 --detail --fail-based-on-results

# Evaluate against a specific policy instead of the active one
anchorectl image check registry.example.com/my-service:1.4.0 --policy strict-policy

Flags

Flag	Type	Environment variable	Default	Required	Description
`--base-digest`	string	`ANCHORECTL_IMAGE_CHECK_BASE_DIGEST`	`auto`	No	Base image digest to compare against so findings report inherited_from_base; `auto` resolves the base image automatically, empty disables the comparison.
`--detail`	bool	`ANCHORECTL_IMAGE_CHECK_DETAIL`	`false`	No	Show each failed gate within the policy evaluation report.
`-f`, `--fail-based-on-results`	bool	`ANCHORECTL_FAIL_BASED_ON_RESULTS`	`false`	No	Set the return code to 1 if the policy evaluation result shows as `fail`.
`--history`	bool	`ANCHORECTL_IMAGE_CHECK_HISTORY`	`false`	No	Show all previous policy evaluations.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results (HTML available with `--detail`). Allowable values: `text`, `json`, `json-raw`, `id`, `csv`, `html`. See Output Formats.
`-d`, `--output-directory`	string	`ANCHORECTL_OUTPUT_DIRECTORY`	`""`	No	Optional output directory to write results to.
`-p`, `--policy`	string	`ANCHORECTL_POLICY`	`""`	No	The policy name or ID to evaluate against (if not provided the default policy is used).
`-t`, `--tag`	string	`ANCHORECTL_IMAGE_TAG`	`""`	No	Specify which tag (repo:tag) is evaluated for a given image ID or Image digest.

image content

Get image content.

anchorectl image content IMAGE [flags]

Aliases: contents

Arguments

Argument	Description
`IMAGE`	The image ID, digest, or name:tag to fetch content of.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-a`, `--available-types`	bool	`ANCHORECTL_AVAILABLE_TYPES`	`false`	No	Only show available content types and exit.
`--file`	string	`ANCHORECTL_FILE`	`""`	No	A file path to write a .tar file containing all retrieved files.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.
`--overwrite`	bool	`ANCHORECTL_OVERWRITE`	`false`	No	Write over an existing file when saving retrieved files tarball.
`-t`, `--type`	string (repeatable)	`ANCHORECTL_CONTENT_TYPES`	`[]`	No	Filter down results to one or more vulnerability types; use `--available-types` to see valid values (default: fetch all available types).

image delete

Delete an image analysis.

anchorectl image delete IMAGE... [flags]

Aliases: del

Arguments

Argument	Description
`IMAGE`	One or more images to delete (can be a digest, id or registry/repo:tag). If no tag supplied defaults to `latest`.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-a`, `--all`	bool	—	`false`	No	Delete all images.
`-f`, `--force`	bool	`ANCHORECTL_IMAGE_DELETE_FORCE`	`false`	No	Force deletion of image by cancelling any subscription/notification settings prior to image delete.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

image get

Get information about a single image.

anchorectl image get IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The image ID, `name:tag`, `name@sha256:digest`, `name:tag@sha256:digest`, or `sha256:digest` value.

Flags

Flag	Type	Environment variable	Default	Required	Description
`-i`, `--digest`	string	`ANCHORECTL_IMAGE_DIGEST`	`""`	No	The image digest.
`--history`	bool	`ANCHORECTL_IMAGE_HISTORY`	`false`	No	Show history of images that match the input image.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

image list

List all images visible to the user.

anchorectl image list [flags]

Flags

Flag	Type	Environment variable	Default	Required	Description
`-s`, `--analysis-status`	string	`ANCHORECTL_IMAGE_ANALYSIS_STATUS`	`""`	No	Filter by analysis_status value on the record. Allowable values: `not_analyzed`, `analyzed`, `analyzing`, `analysis_failed`.
`--history`	bool	`ANCHORECTL_IMAGE_HISTORY`	`false`	No	Include full history of images (duplicate tags with previous content).
`-i`, `--image`	string	`ANCHORECTL_IMAGE_NAME`	`""`	No	Tag-based docker-pull string to filter results by (e.g. docker.io/library/nginx:latest, or myhost.com:5000/testimages:v1.1.1).
`--image-status`	string	`ANCHORECTL_IMAGE_STATUS`	`active`	No	Filter by “image_status” value on the record. Allowable values: `all`, `active`, `deleting`.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `id`. See Output Formats.

image metadata

Get image metadata.

anchorectl image metadata IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The image ID, digest, or name:tag to fetch metadata of.

Flags

Flag	Type	Environment variable	Default	Required	Description
`--file`	string	`ANCHORECTL_FILE`	`""`	No	A file path to write the metadata out to.
`--overwrite`	bool	`ANCHORECTL_OVERWRITE`	`false`	No	Write over existing metadata files.
`-t`, `--type`	string	`ANCHORECTL_METADATA_TYPE`	`""`	No	Filter down results to one or more vulnerability types (run command without this flag to see available types for the given image).

image one-time-scan

Analyze a container image.

anchorectl image one-time-scan IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The container image to analyze (e.g. docker.io/library/nginx:latest).

Examples

anchorectl image one-time-scan ghcr.io/anchore/enterprise-test-images:latest

Flags

Flag	Type	Environment variable	Default	Required	Description
`--detail`	bool	`ANCHORECTL_DETAIL`	`false`	No	Show policy evaluation details (always enabled for HTML output).
`--dockerfile`	string	`ANCHORECTL_DOCKERFILE`	`""`	No	Path to Dockerfile to use for analysis.
`--extended-support`	string	`ANCHORECTL_EXTENDED_SUPPORT`	`""`	No	Use Extended Update Support (EUS) data during the vulnerability scan. Will use the system configured behaviour if not provided. Allowable values: `true`, `false`.
`--fail-on-policy-error`	bool	`ANCHORECTL_FAIL_ON_POLICY_ERROR`	`false`	No	Fail if policy evaluation fails.
`-o`, `--format`	string	`ANCHORECTL_FORMAT`	`text`	No	Output format (text, JSON, json-raw, HTML).
`--from`	string	`ANCHORECTL_FROM`	`registry`	No	Source of the image to analyze (registry, docker, or podman) (docker and podman: if the image is not present in the daemon it is pulled from the registry).
`-d`, `--output-directory`	string	`ANCHORECTL_OUTPUT_DIRECTORY`	`""`	No	Optional output directory to write results to.
`--platform`	string	`ANCHORECTL_PLATFORM`	`""`	No	Platform to use for analysis.
`-p`, `--policy`	string	`ANCHORECTL_POLICY`	`""`	No	Policy bundle (name or id) to use for evaluation.

image sbom

Get image SBOM in the native Anchore format.

anchorectl image sbom IMAGE [flags]

Arguments

Argument	Description
`IMAGE`	The image reference (ID, digest, name:tag).

Flags

Flag	Type	Environment variable	Default	Required	Description
`-x`, `--exclude-files`	bool	`ANCHORECTL_EXCLUDE_FILES`	`false`	No	Exclude files from the SBOM (this only valid for CycloneDX formats.
`-f`, `--file`	string	`ANCHORECTL_FILE`	`""`	No	Write the SBOM content to a file (instead of STDOUT).
`-o`, `--output`	string	—	`syft-json`	No	Report output format, options: `cyclonedx-json`, `cyclonedx-xml`, `purls`, `spdx-json`, `spdx-tag-value`, `syft-json`, `table`, `text`. See Output Formats.
`--overwrite`	bool	`ANCHORECTL_OVERWRITE`	`false`	No	Write over existing SBOM files.

image vulnerabilities

Get image vulnerabilities.

anchorectl image vulnerabilities IMAGE [flags]

Aliases: vulns, vuln

Arguments

Argument	Description
`IMAGE`	The image ID, digest, or name:tag to fetch vulnerabilities for.

Examples

# All vulnerabilities for an image
anchorectl image vulnerabilities registry.example.com/my-service:1.4.0

# Only OS package findings the vendor has not marked as won't-fix
anchorectl image vulnerabilities registry.example.com/my-service:1.4.0 --type os --vendor-only

# Write JSON results to a directory. --output-directory accepts only
# json, json-raw, html, and csv
anchorectl image vulnerabilities registry.example.com/my-service:1.4.0 --output json --output-directory ./reports

# CycloneDX output requires an image digest, not a tag
anchorectl image vulnerabilities sha256:<DIGEST> --output cyclonedx-json

Flags

Flag	Type	Environment variable	Default	Required	Description
`--annotations`	string (repeatable)	`ANCHORECTL_VULNERABILITY_ANNOTATIONS`	`[]`	No	Filter results to include only vulnerabilities with the given annotation status. Accepts a comma separated list of: `not_affected`, `affected`, `fixed`, `under_investigation`.
`-a`, `--available-types`	bool	—	`false`	No	Only show available vulnerability types and exit.
`--include-description`	bool	`ANCHORECTL_VULNERABILITY_INCLUDE_DESCRIPTION`	`false`	No	Include full descriptions in the vulnerability result.
`-o`, `--output`	string	`ANCHORECTL_FORMAT`	`text`	No	The format to show the results. Allowable values: `text`, `json`, `json-raw`, `csv`, `cyclonedx-json`, `cyclonedx-xml`, `html`. See Output Formats.
`-d`, `--output-directory`	string	`ANCHORECTL_OUTPUT_DIRECTORY`	`""`	No	Optional output directory to write results to.
`-r`, `--refresh`	bool	`ANCHORECTL_VULNERABILITY_REFRESH`	`false`	No	Refresh the vulnerability match results against the original artifact.
`-t`, `--type`	string (repeatable)	`ANCHORECTL_VULNERABILITY_TYPE`	`[]`	No	Filter down results to one or more vulnerability types.
`--vendor-only`	bool	`ANCHORECTL_VULNERABILITY_VENDOR_ONLY`	`false`	No	Filter results to include only vulnerabilities that are not marked as invalid by upstream OS vendor data. When set to true, it will filter out all vulnerabilities where will_not_fix is False. If false all vulnerabilities are returned regardless of `will_not_fix`.

Last modified September 22, 2026