> For the complete documentation index, see [llms.txt](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/findings/containers/scanning-and-retention.md).

# Scanning and Retention

When a container image is first scanned, when it is scanned again, what happens to a failed scan, and how long results are kept.

This page is the reference for the container scan cadence: what triggers a scan, how often an image is re-read, and when its results are removed.

## First scan

An image is scanned the first time Heeler sees its digest, by either route:

| Trigger              | When it applies                                                                                                                                |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |
| **Registry push**    | A tagged image is pushed to a connected Amazon ECR or Google Artifact Registry repository, and event collection is configured on that account. |
| **Running workload** | A workload in a connected account references a digest that is not yet in the inventory.                                                        |

## Rescans

| Rule                        | Behaviour                                                                                                                                                       |
| --------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Re-push within 24 hours     | A push of a digest scanned within the last **24 hours** does not start another scan.                                                                            |
| Image with a live workload  | Rescanned **daily**, so a long-running deployment picks up newly published advisories.                                                                          |
| Image with no live workload | Scanned again only when the digest is pushed again.                                                                                                             |
| Base image evaluation       | Each distinct base image is listed and rescanned every **7 days**. See [Base Image Upgrades](/mrecEO40m5D6bt7Pq5pE/findings/containers/base-image-upgrades.md). |

One scan covers one digest. Where the same digest sits in several repositories, every row carrying it gets the result.

## A failed scan

A scan that fails is retried after **1 hour**, up to **3 attempts** in total.

The **Scan** column and the header badge read **Failed**; hover for the reason. The image drawer's **Scans** card lists every scan attempt on the image with its state, its time and any failure reason.

## Retention

An image and its findings are removed **90 days** after the image was last pushed. A push inside that window extends it.

The image drawer's **Retained Until** term shows the date for that image.

## Related

* [Containers](/mrecEO40m5D6bt7Pq5pE/findings/containers.md) — what a scan records and what it needs.
* [Container Images](/mrecEO40m5D6bt7Pq5pE/findings/containers/images.md) — the Scan column and the Scan Status filter.
* [Base Image Upgrades](/mrecEO40m5D6bt7Pq5pE/findings/containers/base-image-upgrades.md) — the seven-day base evaluation.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.heeler.com/mrecEO40m5D6bt7Pq5pE/findings/containers/scanning-and-retention.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.