Release 1.45.0

September 08, 2026

- Qualys strongly recommends upgrading your Qualys Container Security Sensor to 1.45.0 to avail the latest features and enhancements.
- Ensure that you also update your existing Sensor Deployment YAML files with the latest YAML files published with the 1.45.0 release.

Container Crashloop Detection Support

With this release, the Container Security sensor reduces unnecessary scan activity for unstable workloads by detecting containers stuck in a CrashLoopBackOff restart loop and deferring their scanning.

Containers in restarts 1 through 3 are scanned normally. Starting from the fourth restart, the sensor defers scanning for that container and records the deferral in the sensor logs. If the container eventually stabilizes and runs successfully, the sensor resets the restart count and resumes scanning on the next applicable event.

This capability applies to the General Sensor on all runtimes: Docker, containerd, CRI-O, and Podman, across all cloud providers. Containers excluded from scanning through your existing scan configuration continue to be excluded and are not evaluated by the crashloop detection logic.

To enable crashloop detection, pass the following argument when installing or upgrading the sensor:

--qlys-enableCrashLoopContainerFilter

Detection of Package-in-Use for Running Containers

With this release, package-in-use detection helps you prioritize remediation toward the packages a container is actually exercising at runtime. This capability identifies which installed packages are actually loaded and active in a running container, rather than only reporting every package present in the image.

Package-in-use detection is opt-in and is supported on all runtimes (Docker, containerd, CRI-O, and Podman). To enable it, pass the following argument when installing or upgrading the sensor:

--qlys-pkg-in-use

Package-in-use data is uploaded with each container scan. You can filter vulnerabilities by package-in-use status in the Container Security UI using the quick filter VULNERABILITIES IN USE or the following QQL token:

vulnerabilities.vulnerable.packages.inuse:

Run the sensor in privileged mode to capture packages from containers.
In order to enable it in a Kubernetes environment:

• Under the Volumemounts section, uncomment the following:
  #-mountPath: /host/proc
#name: proc-volume
#readOnly: true
• Under the Volumemounts section, uncomment the following:
  #-name: proc-volume
#hostPath:
#path: /proc
#type: Directory

and,

• Under the Run the sensor in privileged mode section, uncomment the following:
  #securityContext:
#allowPrivilegeEscalation: false
#privileged: true

Discover Repositories Available in a Registry

The Container Security sensor now enables you to view the complete list of repositories available in a connected registry directly from the Qualys Cloud Platform. To retrieve the list, navigate to Registry > Repositories and select Refresh Repositories. The list is populated using the credentials and connection details already configured for the registry, allowing you to select the repositories you want to scan without referencing information outside the platform.

For Google Artifact Registry (GAR), empty repositories are not returned by the registry and therefore do not appear in the list.

Scanning Support for BusyBox-Based Images

You can now scan container images built on BusyBox. Previously, BusyBox-based images were not fully supported for scanning, which meant customers using minimal or embedded-style images built on BusyBox had incomplete visibility into their operating system and software composition.

With this release, the sensor correctly detects the BusyBox-based operating system and collects the applicable package inventory and vulnerability data for these images, consistent with other supported Linux distributions. This enhancement applies to both static and dynamic scanning.

Enhanced JAR Detection for Offline Scans

With this release, Java vulnerability scans in offline or network-restricted environments are more accurate and complete, and no longer require a separate proxy allowance for an external Java database URL. Previously, the Java package database required for scanning Java packages was downloaded from an external, unauthenticated public source each time a scan required it; scans in offline or network-restricted environments could not download this database, resulting in reduced Java vulnerability coverage.

With this release, the Java package database is hosted by Qualys and delivered through the same channel as your other scan content. This improves scan coverage and accuracy for Java packages in offline-scan mode and removes the need to configure a separate proxy allowance for an external Java database URL.

We have introduced a new flag that allows you to disable offline JavaDB collection.
--qlys-disable-javadb-collection

Use canonical Java packages published by the original package maintainers instead of third-party republished forks. Using the original packages helps ensure accurate vulnerability detection and reduces the risk of false positives or false negatives caused by incorrect package identification.

Static Container Scanning Support for CRI-O and Podman Container Runtimes

We have extended static container scanning to the CRI-O and Podman container runtimes. Static scanning lets you scan container images without requiring the container to be running, which is useful for scanning images at rest or during a build pipeline.

With this release, you can apply the same static scanning workflow to workloads running on CRI-O and Podman that you already use for Docker-based environments. Static scanning for docker-windowsfilter on Windows has also been added with this phase. This enhancement is selectable per deployment; you can choose static scanning, dynamic scanning, or both, depending on your configuration.

JFrog Registry Enhancement for Docker Login and Pull Commands

Registry scans that previously failed for JFrog registries configured with a virtual repository backed by a local repository now succeed. In some JFrog configurations, the repository name returned during discovery did not match the name required to log in to and pull from the registry, which caused these scans to fail.

With this release, the registry sensor correctly resolves the login and pull commands for this JFrog virtual-repository configuration. No configuration change is required; the registry sensor applies the corrected behavior automatically.

New Parameter for Containerd Socket Directory in installsensor.sh

With this release, you can pass a new parameter to installsensor.sh to specify a custom containerd socket directory. Use this parameter when the containerd socket on your host is located at a non-default path — for example, because Docker 29 introduced a containerd socket mount as part of your sensor deployment. Previously, the installer used a fixed socket path with no option to override the default.

Pass the following parameter to specify the containerd socket directory:

DockerOverlayFSSocketDirectory=<Containerd socket directory path>

This is consistent with the existing parameters already available for customizing the Docker and Podman socket directories.

Sensor Deployment with Minimum Required Linux Capabilities

Previously, the QCS sensor deployment had no capability restrictions defined in the securityContext — only allowPrivilegeEscalation: false was set. This meant the sensor container ran with the full default set of Linux capabilities.

With this release, the QCS sensor deployment runs with the minimum required Linux capabilities instead of the full default set. The securityContext now explicitly drops ALL Linux capabilities and adds back only the minimum capability required for scanning, DAC_OVERRIDE, so deployments continue to scan successfully.

For Containerd:
securityContext:
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
    add:
      - DAC_OVERRIDE # File/directory permission bypass (required for qscanner cache creation)

For CRI-O:
securityContext:
  privileged: false
  capabilities:
    drop: ["ALL"]
    add:
      - DAC_OVERRIDE # File/directory permission bypass (required for qscanner cache creation)

This change is applicable to YAML and Helm. With 1.45.0, sensor deployment by default will happen with the mentioned minimum required capabilities.

Issues Addressed

The following reported and notable customer issues are fixed in this release.

Category	Issue
General Sensor	Fixed an issue where a local image built with the buildah tool on containerd was not scanned for all its architectures on the General Sensor. All architectures of a locally built multi-architecture image are now scanned on the General Sensor.
Registry Sensor / JFrog	Fixed an issue where registry scanning failed with a manifest not found error for a subset of images in a JFrog registry, even though the same images could be pulled manually. Registry scans for JFrog registries now correctly resolve the manifest for these images.