How do I leverage Container Image Layer attributes (Base vs App) in Policies?

Last updated: March 16, 2026

Context

Many Engineering teams use shared base images (or golden images) maintained by an infrastructure or platform team, while application layers are owned by product engineering.

In this mixed-ownership model, they want to:

  • Route base‑image findings (OS packages, shared runtimes) to the platform/infrastructure team.

  • Route app‑layer findings (frameworks, app deps) to application teams.

  • Optionally, route findings to specific layer owners when multiple teams contribute layers to the same image.

Endor’s default Container policy templates do not currently surface layer ownership as a configurable field, but the platform already computes this in the finding metadata and can be targeted via custom OPA/Rego policies.

Answer

Endor exposes two key attributes on container findings:

  • spec.finding_metadata.container_data.has_base_layer

    • true → finding comes from base image layers

    • false → finding comes from application layers

  • spec.finding_metadata.container_data.layer_digests

    • Array of layer SHA digests for the layers that contributed the vulnerable package/file.

For further granularity if a container image is owned by several teams, each layer is computed a hash which can be retrieved from this attribute key:

spec.finding_metadata.container_data.layer_digests

Each hash would need to be hard-coded into a policy as an array in the Rego rule.

Example #1 - Matching on an App Layer Finding

Rego Definition:

package custom_app_layer

match[result] {
  some i
  f := data.resources.Finding[i]
  f.spec.finding_metadata.container_data.has_base_layer == false
  result := {"Endor": {"Finding": f.uuid}}
}

  • Set your Query Statement field to data.custom_app_layer.match

Example #2 - Matching on a Base Layer Finding

Rego Definition:

package custom_base_layer

match[result] {
  some i
  f := data.resources.Finding[i]
  f.spec.finding_metadata.container_data.has_base_layer == true
  result := {"Endor": {"Finding": f.uuid}}
}

  • Set your Query Statement field to data.custom_base_layer.match