Container Image Usage: Trace Azure Findings
Overview
Container image usage in Spotto connects stored Azure Container Registry image evidence to the applications configured to use those images. The existing resource Relationship Graph shows image identities, tags and configured consumers. Available Microsoft Defender package findings and fixes appear as ordinary Security recommendations, subject to your access and collection coverage.
The initial scope covers App Service applications, deployment slots, and sidecar container configurations, including containerized Function Apps on the same configuration surface. It records configuration and tag resolution at collection time; Running digest not observed means Spotto has not verified the image actually running inside a workload.
Why trace image dependencies?
A security finding identifies a vulnerable image, but you still need to find the applications that require a rebuild or configuration update. Shared tags and repositories make that harder: several applications can reference the same image, and a tag can move to a different digest between collections.
Use the image view to identify configured consumers and inspect the vulnerable software. Use the application view to check which image reference needs attention. This gives you a starting point for remediation and for investigating registry cleanup without treating an untagged image as unused.
Inspect an image and its configured consumers
- Open an Azure registry or application in the Spotto Portal and select its Relationships tab.
- Look for the image node in the existing relationship graph. Increase Dependencies to explore further relationships. Use View in Relationship Graphs to open the full graph and select an image to inspect its details.
- Follow the image's relationships to applications, slots or sidecars. Select a node in the full graph to inspect its published properties. Increase Dependencies to follow longer consumer paths; use +N more to reveal additional members of large groups.
- Open the existing Security view for the registry or a matched consuming resource. Find the recommendation for the image's repository and short digest identifier. Expand its Technical Playbook to review tables of affected packages, detected and reported fixed versions, CVEs and configured consumer examples; the full digest is included there. When more than twenty references were collected, use Affected Resources and the relationship graphs to inspect the full mapping.
- Check the observation time and any incomplete-collection explanation before interpreting the findings. Image properties and security recommendation details are separate because vulnerability information requires Security access.
Image tags are observations of aliases, and their absence does not establish that an image has no consumers.
Read digests, tags, and findings
| Field or state | Meaning |
|---|---|
| Digest | The immutable manifest identity within a registry repository. Two tags pointing to the same digest are aliases of the same image. |
| Tags / Aliases | Names observed during collection. A tag can later point to another digest. |
| Configured reference edge | The configuration names a digest, or a tag resolved to the same digest on both collection checks. Runtime use remains unverified. |
| tag-moved | The tag moved between checks. The graph retains its configured-reference node and withholds a definite image association. |
| unresolved, unsupported, or unavailable | The reference could not be associated with an image using the collected, authorized sources. |
| Package finding | A Defender assessment about affected software. One package finding can contain several CVEs; package counts and distinct CVE counts differ. |
| Available Fixed Version | The fixed version reported by Defender, when present. Fix version unknown means no fixed version was supplied. |
An image index can contain platform-specific child manifests. Inspect those children for their findings, but do not assume an application runs every child: its workload platform may be unknown.
Decide what needs updating
Start with the detected versions, reported fixed versions and CVE details in the image's Security recommendation. Identify whether the affected software comes from your application dependencies or the base image, then update the relevant build inputs, rebuild and scan the image, and deploy the replacement through your normal release process.
For a tag reference, confirm which digest the tag now resolves to. For an explicit digest reference, update the configuration to the replacement digest. After the next successful collection, review the mapping and findings again. Spotto presents the evidence; this view does not rebuild, redeploy, or delete images.
Understand collection coverage
Registry inventory, workload discovery, tag resolution, and vulnerability findings have separate collection outcomes. A successful inventory does not imply that findings or all consumers were collected.
- An incomplete-collection explanation means some evidence is available, but the collected scope is incomplete. A count can be an observed minimum.
- A missing Security recommendation does not prove that an image has no vulnerabilities; Defender evidence may be unavailable or your access may exclude it. Authorized image relationships can still be visible.
- Observation times describe collection evidence. Review the normal graph and Security recommendations after a successful scan when configuration or findings change.
- No usage observed in collected scope. means no consumers were found in the sources that were collected. It does not establish that the image is unused.
The initial collection does not discover Azure Container Apps, Container Instances, Kubernetes workloads, or running container digests. References to another subscription or an external registry can remain unresolved. Permissions, private registry networking, collection limits, and unavailable sources can also leave gaps.
An untagged image or an image with no observed consumers is not a safe-to-delete decision. Check other workload types, deployment history, rollback requirements, and references outside the collected scope before considering cleanup.
Troubleshooting
An expected image relationship is missing
What you're seeing: The resource's existing relationship graph has no expected image node.
Likely causes: No image association was observed in the collected workload scope, the subscription has not completed collection, the stored evidence is stale, or a source could not be read. There is no separate Container Images menu or section to enable.
How to investigate: Wait for a successful subscription scan and review the published node properties and scan status. Ask your Spotto administrator to check collection access and registry networking if the source remains unavailable.
A configured application has no definite image association
What you're seeing: A reference is unresolved or changed during collection, or an expected consumer is missing.
Likely causes: The tag moved, the registry is outside the collected subscription, the configuration format is unsupported, or workload discovery was incomplete.
How to investigate: Check the application's configured reference and the tag's current digest. Review coverage and resolution state, then collect again after configuration has settled. Verify other workload types separately.
Findings are restricted, unavailable, or still show an older image
What you're seeing: The expected Security recommendation is absent, its collection is incomplete, or its observed image digest does not match a recent deployment.
Likely causes: Security access is missing, Defender evidence was unavailable, or configuration collection and vulnerability evaluation occurred at different times.
How to investigate: For restricted findings, ask your administrator to review your Security-category access. For unavailable or older findings, compare collection and finding times, confirm the configured digest, and review the latest Defender assessment after the next successful collection.
Looking to enhance your cloud setup for cost efficiency, performance, reliability, or security?
Talk to a cloud specialist. Email us or schedule a 30-minute consultation and let's optimize your cloud environment together.
Book a Free Consultation