Article

For Java teams deploying on the Microsoft Azure platform, Azure Container Registry (ACR) is the natural choice for storing and managing Docker images. While tools like the Docker Scan plugin are great for local development, ACR Scan (now part of Microsoft Defender for Containers) provides enterprise-grade, automated vulnerability assessment directly within your container registry. It ensures that your Java application images are secure before they are deployed to production environments.

What is ACR Scan?

ACR Scan is a native vulnerability scanning solution integrated directly into Azure Container Registry. It automatically scans pushed container images, including all layers, against a continuously updated database of known vulnerabilities (CVEs). For Java teams, this means it analyzes your base JVM image, the operating system packages, and the application layers containing your JAR files and dependencies.

Why ACR Scan is Essential for Java Workloads

1. Automated Registry-Level Security: Unlike local scans, ACR Scan automatically triggers every time you push a new image or retag an existing one (e.g., myapp:latest). This provides a mandatory security gate for all images entering your registry.
2. Deep Dependency Analysis: It excels at identifying vulnerabilities in the complex dependency tree of a Java application. It can flag CVEs not just in the OS layer but also within the JAR files themselves, provided they are documented in public vulnerability databases.
3. Centralized Policy & Compliance: Security and platform teams can define policies to prevent the deployment of images with critical vulnerabilities, enforcing organizational standards across all Java development teams.

How ACR Scan Works with a Java Image

The process is seamless and integrated into your standard CI/CD workflow:

1. Build: You build your Java application's Docker image using a multi-stage build for optimal security. # Example Multi-stage Dockerfile for Java FROM mcr.microsoft.com/openjdk/jdk:17-ubuntu AS builder WORKDIR /app COPY . . RUN ./mvnw clean package -DskipTests FROM mcr.microsoft.com/openjdk/jdk:17-ubuntu RUN useradd -ms /bin/bash javauser USER javauser COPY --from=builder /app/target/my-java-app.jar app.jar ENTRYPOINT ["java", "-jar", "/app.jar"]
2. Push: You push the image to your Azure Container Registry. docker tag my-java-app:latest myacr.azurecr.io/my-java-app:latest docker push myacr.azurecr.io/my-java-app:latest
3. Automatic Scan: The moment the push completes, ACR Scan is automatically triggered.
4. Review: You view the detailed vulnerability report directly in the Azure Portal.

Interpreting the Scan Report for Java

The scan results, accessible via the Azure Portal, Azure CLI, or REST API, are categorized by severity:

• Critical / High: Often related to severe flaws in the base OS image (e.g., vulnerabilities in libc6, openssl) or the JVM runtime itself. For example, using an outdated base image like openjdk:8 would generate numerous high-severity findings.
• Medium / Low: These might include less critical system library issues or vulnerabilities in transitive dependencies bundled within your application JAR.

Key Java-Specific Insights from the Report:

• Base Image Analysis: The report pinpoints if a vulnerability exists in the mcr.microsoft.com/openjdk/jdk:17-ubuntu layer. The remediation is often to wait for Microsoft to publish a patched base image and then rebuild your application.
• Application Layer Vulnerabilities: If a CVE is found in a library within your application layer, it indicates a vulnerable dependency has been bundled into your final JAR. You must update the version of that dependency in your pom.xml or build.gradle and rebuild the image.

Best Practices for Java Teams Using ACR Scan

1. Use Official, Curated Base Images: Prefer the Microsoft-curated OpenJDK images (mcr.microsoft.com/openjdk/jdk) or the Eclipse Temurin images. They are regularly updated and scanned, reducing your initial vulnerability footprint.
2. Integrate Scan Results into CI/CD: Don't just rely on the portal. Use the Azure CLI in your pipeline to break the build based on scan results. # Example command to check scan results in a pipeline az acr repository show --name myacr --repository my-java-app --output table # Use query to check for high-severity vulnerabilities and fail the pipeline
3. Leverage Quality Gates: Configure Azure Policy to enforce that only images that pass ACR Scan (or have vulnerabilities below a specific threshold) can be deployed to Azure Kubernetes Service (AKS) or Azure Container Instances (ACI).
4. Enable Microsoft Defender for Cloud: ACR Scan is a feature of Microsoft Defender for Containers. Enabling it provides a unified security management view across your registries and Kubernetes clusters, with advanced threat detection for running Java workloads.
5. Schedule Regular Re-scans: Vulnerability databases are updated daily. Configure ACR to periodically re-scan your existing images (even those that passed initially) to catch newly discovered threats. This is crucial for long-lived "stable" tags in production.
6. Minimize Attack Surface with Multi-Stage Builds: As shown in the Dockerfile example, use multi-stage builds to ensure your final production image contains only the JRE and the application JAR—not the build tools, source code, or Maven dependencies downloaded at build time.

Conclusion

ACR Scan moves container security from a local developer concern to an integrated, automated part of the cloud deployment pipeline. For Java teams on Azure, it provides a critical, non-negotiable security checkpoint. By leveraging ACR Scan alongside development best practices like using minimal base images and multi-stage builds, you can confidently deliver secure Java applications, knowing that every container image is continuously monitored and assessed for known vulnerabilities before it ever reaches a production node.

Secure Java Dependency Management, Vulnerability Scanning & Software Supply Chain Protection (SBOM, SCA, CI Security & License Compliance)

https://macronepal.com/blog/github-code-scanning-in-java-complete-guide/
Explains GitHub Code Scanning for Java using tools like CodeQL to automatically analyze source code and detect security vulnerabilities directly inside CI/CD pipelines before deployment.

https://macronepal.com/blog/license-compliance-in-java-comprehensive-guide/
Explains software license compliance in Java projects, ensuring dependencies follow legal requirements (MIT, Apache, GPL, etc.) and preventing license violations in enterprise software.

https://macronepal.com/blog/container-security-for-java-uncovering-vulnerabilities-with-grype/
Explains using Grype to scan Java container images and filesystems for known CVEs in OS packages and application dependencies to improve container security.

https://macronepal.com/blog/syft-sbom-generation-in-java-comprehensive-software-bill-of-materials-for-jvm-applications/
Explains using Syft to generate SBOMs (Software Bill of Materials) for Java applications, listing all dependencies, libraries, and components for supply chain transparency.

https://macronepal.com/blog/comprehensive-dependency-analysis-generating-and-scanning-sboms-with-trivy-for-java/
Explains using Trivy to generate SBOMs and scan Java dependencies and container images for vulnerabilities, integrating security checks into CI/CD pipelines.

https://macronepal.com/blog/dependabot-for-java-in-java/
Explains GitHub Dependabot for Java projects, which automatically detects vulnerable dependencies and creates pull requests to update them securely.

https://macronepal.com/blog/parasoft-jtest-in-java-comprehensive-guide-to-code-analysis-and-testing/
Explains Parasoft Jtest, a static analysis and testing tool for Java that helps detect bugs, security issues, and code quality problems early in development.

https://macronepal.com/blog/snyk-open-source-in-java-comprehensive-dependency-vulnerability-management-2/
Explains Snyk Open Source for Java, which continuously scans dependencies for vulnerabilities and provides automated fix suggestions and monitoring.

https://macronepal.com/blog/owasp-dependency-check-in-java-complete-vulnerability-scanning-guide/
Explains OWASP Dependency-Check, which scans Java dependencies against the National Vulnerability Database (NVD) to detect known security vulnerabilities.

https://macronepal.com/blog/securing-your-dependencies-a-java-developers-guide-to-whitesource-mend-bolt/
Explains Mend (WhiteSource) Bolt for Java, a dependency management and SCA tool that provides vulnerability detection, license compliance, and security policy enforcement in enterprise environments.