> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/container-scanning/base-image-vulnerabilites/approve-base-image.md).

# Approve Base Image

In many organizations, security teams vet and approve specific base images for developers to use. Even if these images contain known vulnerabilities, they are considered acceptable. STO's **Base Image Approval** feature helps you implement this process and enforce policies on it. This document covers:

* [What is Base Image Approval?](#what-is-base-image-approval)
* [How to Approve a Base Image?](#how-to-approve-a-base-image)
* [Policies for Vulnerabilities from Application and Base Images](#policies-for-vulnerabilities-from-application-and-base-images)

{% hint style="info" %}

* This feature is behind the feature flags `STO_BASE_IMAGE` and `STO_BASE_IMAGE_DETECTION`. Contact [Harness Support](mailto:support@harness.io) to enable this flag.
* Currently, this feature is supported only for scans using **Orchestration** scan mode. Support for **Ingestion** and **Extraction** scan modes will be available soon.
  {% endhint %}

{% embed url="<https://youtu.be/pUejMRl43DA>" %}

#### What is Base Image Approval? <a href="#what-is-base-image-approval" id="what-is-base-image-approval"></a>

Base Image Approval is a manual process where you explicitly approve one or more tags of a base image target in STO. This action signals that the selected base image tags are trusted for use in your pipelines. When you scan an application image built on an approved base image tag, you will find the scan results with the following indicators:

* **UI Indicator**: Vulnerabilities originating from the approved base image are marked with a [**green** `Base Image` label](#how-to-view-vulnerabilities-from-approved-base-image) in the **Vulnerabilities tab**. Vulnerabilities from unapproved base images are marked in **blue**.
* **Step Output Variable**: The `BASE_IMAGE_APPROVED` output variable in the scanner step is set to `true`. This variable allows you to create policies to ignore vulnerabilities from approved base images.

#### How to Approve a Base Image <a href="#how-to-approve-a-base-image" id="how-to-approve-a-base-image"></a>

Before approving a base image, make sure you’ve reviewed [What is Base Image Approval?](#what-is-base-image-approval) and understood the process. To approve a base image, you must have the **Approve / Reject** permission for **Test Targets** in the project where you want to approve the base image. Or you must have the **Security Testing AppSec** role assigned. Refer to the [RBAC documentation](/security-testing-orchestration/3.0/troubleshooting-and-resources/rbac.md) for more information.

{% hint style="warning" %}
Approving a base image in a project is applied across the **entire account**. Once approved, the base image is considered trusted throughout the account, including all organizations and projects even those you may not have direct access to. Be aware that the approval will be applied at the account level.
{% endhint %}

A base image can only be approved in the project where it was last scanned. If you try to approve it elsewhere, the approval will not take effect.

<details>

<summary>Identify the Correct Project to Approve</summary>

To identify the correct project:

1. Go to your pipeline execution window.
2. Switch to **Vulnerabilities** tab.
3. Open the issue details of a vulnerability labeled with `Base`.
4. Check the **Base Origin** field. This field displays the project name where the base image was last scanned.

For example, the **Base Origin** might appear as: `Base_Image_testing_2/baseimagescan/openjdk`. This aligns with the format `OrgName/ProjectName/TargetName`. You can approve the base image in the `baseimagescan` project.

</details>

To approve a base image, follow the steps:

1. Go to **Test Targets** page from the left navigation.
2. Find your base image (target) in the list. (for example, `openjdk`).
3. Click the ellipsis menu on the right and select **Approve Base Image**.
4. In the dialog, select one or more tags of the base image to approve (for example, `bookworm-slim`).
5. Click **Submit**.

To unapprove a base image, you can follow the same steps and deselect the tags you want to unapprove and click **Confirm**. The approval or unapproval takes effect from the next pipeline execution.

#### How to view Vulnerabilities from Approved Base Image <a href="#how-to-view-vulnerabilities-from-approved-base-image" id="how-to-view-vulnerabilities-from-approved-base-image"></a>

To view the vulnerabilities associated with the approved base image, follow these steps:

{% hint style="info" %}
Before proceeding, make sure that:

* You have configured [base image detection](/security-testing-orchestration/use-sto/set-up-sto-scans/container-scanning/base-image-vulnerabilites/base-image-detection.md#how-to-configure-base-image-detection).
* You approved the base image by following the steps in [How to Approve a Base Image](#how-to-approve-a-base-image). Once approved, the approval will take place from the next pipeline execution after the approval.
  {% endhint %}

1. Go to **Security Testing Orchestration** module.
2. Go to **Execution** page from the left navigation.
3. Find the pipeline execution with your container image scanning and open it.
4. Go to **Vulnerabilities** tab.
5. You will see the vulnerabilities from approved base image marked with a **green** `Base Image` label.

#### Policies for Vulnerabilities from Application and Base Images <a href="#policies-for-vulnerabilities-from-application-and-base-images" id="policies-for-vulnerabilities-from-application-and-base-images"></a>

You can enforce policies on vulnerabilities from both application layers and base images by using the step output variables of your scanner step. Refer to [Step Output Variables for App and Base Image Vulnerabilities](/security-testing-orchestration/use-sto/set-up-sto-scans/container-scanning/base-image-vulnerabilites/base-image-detection.md#step-output-variables-for-app-and-base-image-vulnerabilities) for details.

Depending on your use case, you can apply the following sample policies:

* [Warn or Block Vulnerabilities from Application Layer](/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance/create-opa-policies.md#warn-or-block-vulnerabilities-from-application-layers-of-your-container-image): Use this policy to enforce actions on vulnerabilities originating from the application layers of the container image.
* [Warn or Block Vulnerabilities from Base Image](/security-testing-orchestration/3.0/use-sto/enforce-sto-policies-for-governance/create-opa-policies.md#warn-or-block-vulnerabilities-from-base-image-of-your-container-image): Use this policy to check if the base image is approved. If it is not approved, you can configure the policy to warn or block vulnerabilities from the base image.