Feature Request: Show Tag-Level Vulnerability & Image Metadata in Microsoft Container Registry (MCR) UI

[asilverman]

Summary

Please enhance the MCR UI to display tag-level metadata (per OS/ARCH build) including vulnerability summaries, compressed size, last pushed, digest, and architecture, similar to the Docker Hub Tags tab. This will make it much easier for engineers to quickly assess image risk and pick the correct, up‑to‑date tag without resorting to external tools.

Current

Desired

[terencet-dev]

Hi @asilverman, thanks for your feedback. We'll add this to our backlog

[asilverman]

Hi @terencet-dev, any update on this?

[terencet-dev]

Hi @asilverman, this feature is rolled out in Azure/acr#810. We are working with the publishers to publish vulnerability reports alongside with the images. We do not have an ETA for that at the moment.

[asilverman]

Thanks for the update @terencet-dev and the pointer to Azure/acr#810 — appreciate the progress here.

Two follow-ups that would really help us plan adoption:
1. Is there any rough ETA (even a broad one) for when vulnerability reports will be published alongside images in MCR?
2. Will there be documentation and supported APIs/CLI surfaces for programmatic access to this data (e.g., tag-level vulnerability metadata via REST, az CLI, or ARM)?

This would unlock automation scenarios like policy enforcement, CI gating, and environment bootstrap scripts, so having clarity on access patterns would be very helpful. Thanks again for pushing this forward.

[terencet-dev]

Hi @asilverman

1. Is there any rough ETA (even a broad one) for when vulnerability reports will be published alongside images in MCR? - No rough ETA at the moment. We have in our backlog to work with partners to publish these reports.

2. Will there be documentation and supported APIs/CLI surfaces for programmatic access to this data (e.g., tag-level vulnerability metadata via REST, az CLI, or ARM)? - We plan to have documentation once we get the initial reports published.