From 5c8eafc50689707ed1a07c6775294749dc77a28e Mon Sep 17 00:00:00 2001 From: Leo Wang Date: Mon, 13 Jul 2026 16:58:51 -0400 Subject: [PATCH 1/4] Update Agentless Scanning compatibility: GAR Preview, RDS beta, EKS Fargate support --- .../setup/agentless_scanning/compatibility.md | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md b/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md index f13842cc64b..1191bebe63d 100644 --- a/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md +++ b/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md @@ -18,11 +18,11 @@ The following table provides a summary of Agentless Scanning technologies in rel | Encryption | AWS
Unencrypted
Encrypted - Platform Managed Key (PMK) and Customer Managed Key (CMK) | Encrypted - Platform Managed Key (PMK): Azure Disk Storage Server-Side Encryption, Encryption at host
**Note**: Encrypted - Customer Managed Key (CMK) is **not** supported | Encrypted - Platform Managed Key (PMK): Persistent Disk Encryption, Confidential VM
**Note**: Encrypted - Customer Managed Encryption Key (CMEK) and Customer-Supplied Encryption Keys (CSEK) are **not** supported | | Container runtime | Docker, containerd
**Note**: CRI-O is **not** supported | Docker, containerd
**Note**: CRI-O is **not** supported | Docker, containerd
**Note**: CRI-O is **not** supported | | Serverless | AWS Lambda
AWS Fargate for ECS | Azure Container Apps and Azure Container Instances
**Note**: Requires the latest agentless scanner. See [Update Agentless Scanning][17]. | Cloud Run (container deployment only — not from GitHub repos or inline editors) | -| Kubernetes | EKS on EC2 nodes only
**Note**: Fargate-backed EKS nodes are **not** supported | AKS on virtual machines and Virtual Machine Scale Sets (VMSS)
**Note**: AKS on ACI is **not** supported | GKE Standard only
**Note**: GKE Autopilot and image streaming are **not** supported | +| Kubernetes | EKS on EC2 nodes
EKS on Fargate
**Note**: EKS on Fargate requires the [Datadog Cluster Agent][18] to be installed | AKS on virtual machines and Virtual Machine Scale Sets (VMSS)
**Note**: AKS on ACI is **not** supported | GKE Standard only
**Note**: GKE Autopilot and image streaming are **not** supported | | Application languages (in hosts and containers) | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | -| Container Registries | Amazon ECR (public and private): scans running container images and the last 1,000 pushed images at rest | ACR: scans running container images only
**Note:** To request at-rest registry scanning, contact [Datadog Support][16] | Google Artifact Registry: scans images from running workloads only
**Note:** To request at-rest registry scanning, contact [Datadog Support][16] | +| Container Registries | Amazon ECR (public and private): scans running container images and the last 1,000 pushed images at rest | ACR: scans running container images only
**Note:** To request at-rest registry scanning, contact [Datadog Support][16] | Google Artifact Registry (Preview): scans images from running workloads only
**Note:** Google Artifact Registry support is in Preview. To request access, contact [Datadog Support][16] | | Host Images | AMI | Not supported | Not supported | -| Sensitive Data (SDS) | S3, RDS (private beta) | Not supported | Not supported | +| Sensitive Data (SDS) | S3
RDS (private beta): To request access, contact [Datadog Support][16] | Not supported | Not supported | **Note**: AMIs must be stored in an account that uses Datadog's AWS integration. Otherwise, Datadog can't read the AMI's underlying Amazon Elastic Block Store (EBS) snapshot, so it can't scan or report on the AMI. @@ -69,7 +69,7 @@ The following container image registries are supported for container image scans | Registry | Support level | Notes | |---------------------------------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Amazon ECR (public and private) | GA | Scans running container images **and** the last 1,000 pushed images at rest (by date). This is the only registry with at-rest scanning support | -| Google Artifact Registry (GAR) | GA | Scans images tied to running workloads (Cloud Run, GKE) only
**Note**: To request at-rest registry scanning, contact [Datadog Support][16] | +| Google Artifact Registry (GAR) | Preview | Scans images tied to running workloads (Cloud Run, GKE) only
**Note**: Google Artifact Registry support is in Preview. To request access, contact [Datadog Support][16] | | Azure Container Registry (ACR) | GA | Scans running container images from Azure Container Apps and Azure Container Instances only
**Note**: To request at-rest registry scanning, contact [Datadog Support][16] | **Note**: Container image scanning from registry is only supported if you have installed Agentless with: @@ -102,3 +102,4 @@ The following container runtimes are supported: [15]: https://ubuntu.com/security/cve [16]: /help [17]: /security/cloud_security_management/setup/agentless_scanning/update +[18]: /containers/cluster_agent/setup/ From 043b754604e03838384f370c68d36989099be720 Mon Sep 17 00:00:00 2001 From: leo-wang-dd Date: Mon, 13 Jul 2026 17:06:53 -0400 Subject: [PATCH 2/4] Update compatibility.md --- .../setup/agentless_scanning/compatibility.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md b/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md index 1191bebe63d..6f53cd15f9a 100644 --- a/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md +++ b/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md @@ -69,7 +69,7 @@ The following container image registries are supported for container image scans | Registry | Support level | Notes | |---------------------------------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Amazon ECR (public and private) | GA | Scans running container images **and** the last 1,000 pushed images at rest (by date). This is the only registry with at-rest scanning support | -| Google Artifact Registry (GAR) | Preview | Scans images tied to running workloads (Cloud Run, GKE) only
**Note**: Google Artifact Registry support is in Preview. To request access, contact [Datadog Support][16] | +| Google Artifact Registry (GAR) | Preview | Scans images tied to running workloads (Cloud Run, GKE) only
**Note**: Google Artifact Registry at-rest scanning support is in Preview. To request access, contact [Datadog Support][16] | | Azure Container Registry (ACR) | GA | Scans running container images from Azure Container Apps and Azure Container Instances only
**Note**: To request at-rest registry scanning, contact [Datadog Support][16] | **Note**: Container image scanning from registry is only supported if you have installed Agentless with: From 7e06b6a81abff064196e93086b59736ed7564860 Mon Sep 17 00:00:00 2001 From: Janine Chan Date: Mon, 13 Jul 2026 16:11:13 -0600 Subject: [PATCH 3/4] Picky capitalization; remove duplicates --- .../setup/agentless_scanning/compatibility.md | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md b/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md index 8ed369f7f61..5922bd2a5ff 100644 --- a/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md +++ b/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md @@ -20,8 +20,7 @@ The following table provides a summary of Agentless Scanning technologies in rel | Serverless | AWS Lambda
AWS Fargate for ECS | Azure Container Apps and Azure Container Instances
**Note**: Requires the latest agentless scanner. See [Update Agentless Scanning][17]. | Cloud Run (container deployment only — not from GitHub repos or inline editors) | | Kubernetes | EKS on EC2 nodes
EKS on Fargate
**Note**: EKS on Fargate requires the [Datadog Cluster Agent][18] to be installed | AKS on virtual machines and Virtual Machine Scale Sets (VMSS)
**Note**: AKS on ACI is **not** supported | GKE Standard only
**Note**: GKE Autopilot and image streaming are **not** supported | | Application languages (in hosts and containers) | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | -| Container Registries | Amazon ECR (public and private): scans running container images and the last 1,000 pushed images at rest | ACR: scans running container images only
**Note:** To request at-rest registry scanning, contact [Datadog Support][16] | Google Artifact Registry (Preview): scans images from running workloads only
**Note:** Google Artifact Registry support is in Preview. To request access, contact [Datadog Support][16] | -| Container Registries | Amazon ECR (public and private): scans running container images and the last 1,000 pushed images at rest | ACR: scans running container images only
**Note:** To request at-rest registry scanning or to increase the number of at-rest images to scan, contact [Datadog Support][16] | Google Artifact Registry: scans images from running workloads only
**Note:** To request at-rest registry scanning or to increase the numbers of at-rest images to scan, contact [Datadog Support][16] | +| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only
**Note:** To request at-rest registry scanning or to increase the number of at-rest images to scan, contact [Datadog Support][16] | Google Artifact Registry (Preview): Scans images from running workloads only
**Note:** Google Artifact Registry support is in Preview. To request access, contact [Datadog Support][16] | | Host Images | AMI | Not supported | Not supported | | Sensitive Data (SDS) | S3
RDS (private beta): To request access, contact [Datadog Support][16] | Not supported | Not supported | @@ -69,10 +68,8 @@ The following container image registries are supported for container image scans | Registry | Support level | Notes | |---------------------------------|---------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| Amazon ECR (public and private) | GA | Scans running container images **and** the last 1,000 pushed images at rest (by date). This is the only registry with at-rest scanning support | -| Google Artifact Registry (GAR) | Preview | Scans images tied to running workloads (Cloud Run, GKE) only
**Note**: Google Artifact Registry at-rest scanning support is in Preview. To request access, contact [Datadog Support][16] | | Amazon ECR (public and private) | GA | Scans running container images **and** the last 1,000 pushed images at rest (by date). This is the only registry with at-rest scanning support
**Note:** To increase the number of at-rest images to scan, contact [Datadog Support][16] | -| Google Artifact Registry (GAR) | GA | Scans images tied to running workloads (Cloud Run, GKE) only
**Note**: To request at-rest registry scanning, contact [Datadog Support][16] | +| Google Artifact Registry (GAR) | Preview | Scans images tied to running workloads (Cloud Run, GKE) only
**Note**: Google Artifact Registry at-rest scanning support is in Preview. To request access, contact [Datadog Support][16] | | Azure Container Registry (ACR) | GA | Scans running container images from Azure Container Apps and Azure Container Instances only
**Note**: To request at-rest registry scanning, contact [Datadog Support][16] | **Note**: Container image scanning from registry is only supported if you have installed Agentless with: From 19437ffb67359953bddbdb45b1d638eb10834cd1 Mon Sep 17 00:00:00 2001 From: leo-wang-dd Date: Wed, 15 Jul 2026 14:19:17 -0400 Subject: [PATCH 4/4] Update compatibility.md --- .../setup/agentless_scanning/compatibility.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md b/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md index 5922bd2a5ff..6bef0546b50 100644 --- a/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md +++ b/content/en/security/cloud_security_management/setup/agentless_scanning/compatibility.md @@ -20,7 +20,7 @@ The following table provides a summary of Agentless Scanning technologies in rel | Serverless | AWS Lambda
AWS Fargate for ECS | Azure Container Apps and Azure Container Instances
**Note**: Requires the latest agentless scanner. See [Update Agentless Scanning][17]. | Cloud Run (container deployment only — not from GitHub repos or inline editors) | | Kubernetes | EKS on EC2 nodes
EKS on Fargate
**Note**: EKS on Fargate requires the [Datadog Cluster Agent][18] to be installed | AKS on virtual machines and Virtual Machine Scale Sets (VMSS)
**Note**: AKS on ACI is **not** supported | GKE Standard only
**Note**: GKE Autopilot and image streaming are **not** supported | | Application languages (in hosts and containers) | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | Java, .Net, Python, Node.js, Go, Ruby, Rust, PHP, Swift, Dart, Elixir, Conan, Conda | -| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only
**Note:** To request at-rest registry scanning or to increase the number of at-rest images to scan, contact [Datadog Support][16] | Google Artifact Registry (Preview): Scans images from running workloads only
**Note:** Google Artifact Registry support is in Preview. To request access, contact [Datadog Support][16] | +| Container Registries | Amazon ECR (public and private): Scans running container images and the last 1,000 pushed images at rest | ACR: Scans running container images only
**Note:** To request at-rest registry scanning or to increase the number of at-rest images to scan, contact [Datadog Support][16] | Google Artifact Registry (Preview): Scans images from running workloads only
**Note:** Google Artifact Registry at rest scanning support is in Preview. To request access, contact [Datadog Support][16] | | Host Images | AMI | Not supported | Not supported | | Sensitive Data (SDS) | S3
RDS (private beta): To request access, contact [Datadog Support][16] | Not supported | Not supported |