GitLab Builds It. Anchore Secures It.
GitLab’s built in security features are no joke. Dependency scanning, SAST, DAST, secret detection, and license compliance all ship with the platform and run inside your pipelines without any additional tooling. For most vulnerabilities in application code, GitLab’s native scanning gets you most of the way there.
Containers present a different problem. An image that passes a build-time scan today can be running a vulnerable package tomorrow, because the vulnerability was disclosed after the scan ran. GitLab scans what it knows about at the time of the build. It doesn’t watch your running images for new disclosures nor generate or manage the Software Bill of Materials (SBOM) that auditors, regulators, and procurement requirements are increasingly asking for.
That’s where Anchore comes in.
What does Anchore do?
Anchore is an SBOM-powered platform for software supply chain security. Where GitLab’s scanning runs at pipeline time, Anchore provides continuous visibility: it analyzes your containers and source code to generate detailed SBOMs, then continuously monitors those SBOMs against updated vulnerability feeds, malware signatures, and compliance policies.
The key distinction is the SBOM. Most scanning tools check a container against a known vulnerability database at a point in time. Anchore builds a persistent, queryable inventory of everything in that container (packages, file metadata, licenses, and dependencies) and keeps checking it as new intelligence arrives. When a new CVE is published that affects a package in an image you built three months ago, Anchore surfaces that, even though the image hasn’t changed.
How do GitLab and Anchore work together?
The two platforms complement each other at every stage of the pipeline. GitLab handles the build, test, and CI/CD orchestration. Anchore integrates directly into GitLab pipelines to scan images before they’re promoted, enforce policies that block non-compliant images from reaching production, and generate the SBOM artifacts your compliance team needs.
In practice, this looks like an Anchore scan step in your .gitlab-ci.yml that runs after the image build, evaluates the image against your policy set, and either gates promotion or flags violations for review. The results feed back into GitLab’s security dashboard, so developers see findings in the same place they see everything else.
Why it matters for regulated environments
For organizations in regulated industries or government, the combination is particularly important. FedRAMP, NIST 800-53, CMMC, and the DoD Software Factory all have requirements around software composition analysis, vulnerability management, and continuous monitoring that go beyond what a build-time scan satisfies. Anchore’s continuous scanning and SBOM management are built specifically for these requirements, and its federal offering is designed to operate in air-gapped and IL environments.
GitSimple works with both platforms across commercial and public sector environments. If you’re trying to figure out where your current container security posture has gaps, or how to meet a specific compliance requirement, reach out to us. We can help you map what you need.