Release 1.43

April 24, 2026

Support Scanning of Multi-architecture Images using Registry Sensor

Multi-architecture (multi-arch) images are container images that support multiple CPU architectures (For example, x86_64, ARM64, and so on), allowing a single image reference to work across different hardware platforms. You can scan multi-architectural images using Registry Sensor (a part of qcs-sensor). 
This support is enabled by default. You can find the multi-arch images on Qualys Enterprise TruRisk™ Platform > Assets > Images.

Support of Container Static Scanning

Earlier, CS Sensor used to support only Dynamic scan for containers. With this release, it offers Static Scan for the containers as well.

Container Static Scanning is supported only on sensors running with the following storage drivers:

• Docker overlay2
• Containerd overlayfs
• Containerd GCFS

Sensors running without any of the above storage drivers are not supported for container static scanning.

Sensor without an overlay storage driver is not supported. 

For customers where container scanning is currently disabled, please contact Qualys Support to enable and start using Container Static Scans.

Enhancement in CIS Docker Compliance Scan for Images

The CIS Docker Benchmark defines security best practices to help secure Docker containers and their runtime environments against common threats and misconfigurations.

Qualys Container Security Sensor now supports CIS Docker Compliance Benchmark v1.7.0 scans for container images across all runtimes.
Previously, CIS Docker compliance scanning was limited to Docker-based environments only. With CS Sensor 1.43, this capability has been extended to include the following runtimes:

• Containerd
• Podman
• CRI‑O

CS Sensor Containerd Yaml Updates

The Qualys Container Security package consists of the 'cssensor-containerd-ds.yml' file, which deploys the sensor in an environment with Containerd runtime.
This section explains the updates in the latest cssensor-containerd-ds.yml file. Refer to QCS Sensor Helm Chart (qcs-sensor).

Enhancements

With this release, the following flags are introduced or updated in the 'cssensor-containerd-ds.yml' file. 

Flag/Entity	Status	Flag Location in cssensor-containerd-ds.yml	Description
- mountPath: /run/containerd               name: containerd-fs-dir               readOnly: true               mountPropagation: HostToContainer	New	157 to 160	A new volume mount is introduced to support container static scan.
- name: containerd-fs-dir               hostPath:                 path: /run/containerd	New	186 to 188	A new volume is introduced for container static scan.

Issue Addressed

The following issue has been fixed with this release.

Category	Issue
General Sensor	Fixed an issue where the CS Sensor did not reload the Kubernetes API server token after it expired. As a result, Kubernetes API calls failed once the token expired, impacting inventory reporting and asset scanning. With this fix, the sensor now automatically refreshes the token on expiry for all Kubernetes API (kube-apiserver) calls, ensuring uninterrupted operation after token expiration.