{{ message }}
Repository navigation
Feature Request: Show Tag-Level Vulnerability & Image Metadata in Microsoft Container Registry (MCR) UI #185
Description
Summary
Please enhance the MCR UI to display tag-level metadata (per OS/ARCH build) including vulnerability summaries, compressed size, last pushed, digest, and architecture, similar to the Docker Hub Tags tab. This will make it much easier for engineers to quickly assess image risk and pick the correct, up‑to‑date tag without resorting to external tools.
Current
Desired
Metadata
Metadata
Assignees
Labels
No labels
Activity
terencet-dev commentedon Nov 17, 2025
Hi Ariel Silverman (@asilverman), thanks for your feedback. We'll add this to our backlog
asilverman commentedon Jan 25, 2026
Hi Terence Truong (@terencet-dev), any update on this?
terencet-dev commentedon Jan 27, 2026
Hi Ariel Silverman (@asilverman), this feature is rolled out in Azure/acr#810. We are working with the publishers to publish vulnerability reports alongside with the images. We do not have an ETA for that at the moment.
asilverman commentedon Jan 31, 2026
Thanks for the update Terence Truong (@terencet-dev) and the pointer to Azure/acr#810 — appreciate the progress here.
Two follow-ups that would really help us plan adoption:
1. Is there any rough ETA (even a broad one) for when vulnerability reports will be published alongside images in MCR?
2. Will there be documentation and supported APIs/CLI surfaces for programmatic access to this data (e.g., tag-level vulnerability metadata via REST, az CLI, or ARM)?
This would unlock automation scenarios like policy enforcement, CI gating, and environment bootstrap scripts, so having clarity on access patterns would be very helpful. Thanks again for pushing this forward.
terencet-dev commentedon Feb 10, 2026
Hi Ariel Silverman (@asilverman)
Is there any rough ETA (even a broad one) for when vulnerability reports will be published alongside images in MCR? - No rough ETA at the moment. We have in our backlog to work with partners to publish these reports.
Will there be documentation and supported APIs/CLI surfaces for programmatic access to this data (e.g., tag-level vulnerability metadata via REST, az CLI, or ARM)? - We plan to have documentation once we get the initial reports published.