Unfixable Reviewed

✓ Guardrail Container Scan Guardrails Stable Security And Compliance

container-scan.unfixable-reviewed

Fails on each finding at or above min_severity that has no fix available and no approved exemption.

container unfixable no fix exemption risk acceptance vulnerabilities docker

Get Started View All Container Scan Guardrails

Compatible Integrations

This guardrail works with the following integrations. Click to see how to use Unfixable Reviewed with each collector.

Unfixable Reviewed + Docker Collector Provides container definitions used as the applicability gate

→

Unfixable Reviewed + Snyk Collector Provides container scan results via Snyk Container

→

Enable This Guardrail

Add the parent policy to your lunar-config.yml to enable this guardrail.

📄 lunar-config.yml

policies:
  - uses: github://earthly/lunar-lib/policies/container-scan@v1.0.5
    include: [unfixable-reviewed]
    # with: ...

How This Guardrail Works

This guardrail is part of the Container Scan Guardrails policy. It evaluates data collected by integrations and produces a pass/fail check with actionable feedback.

When enabled, this check runs automatically on every PR and in AI coding workflows, providing real-time enforcement of your engineering standards.

Learn How Lunar Works →

↓ Integrations Gather Data

Collectors extract metadata from code, CI pipelines, tool outputs, and scans

{ } Centralized as JSON

All data merged into each component's unified metadata document

✓ This Guardrail Checks Current

Unfixable Reviewed runs and provides pass/fail feedback

Configuration Options

These inputs can be configured in your lunar-config.yml to customize how the parent policy (and this guardrail) behaves.

Input	Required	Default	Description
`min_severity`	Optional	`high`	Minimum severity to fail on (critical, high, medium, low)
`ignore_unfixable`	Optional	`false`	Only fail max-severity on findings that have a fix available. Unfixable findings are still reported in the component JSON.
`exempt_findings`	Required	—	Vulnerabilities `max-severity` ignores because the risk was reviewed and accepted. Entries are `<id> <package>@<version>`, optionally followed by image globs, separated by newlines or commas: ```yaml with: exempt_findings: \| # bundled inside a vendor tool that hasn't shipped urllib3 2.8.0 CVE-2026-97687 urllib3@2.7.0 registry.example.com/tools:* ``` Id, package and version must match the finding exactly (the id ignores case), so an entry stops matching once the package is upgraded. With globs, only findings in a matching image are exempt, and a finding with no recorded image never is. `#` comments are ignored. Exempt findings stay in the component JSON. The check still fails on the rest, and resolves to `skip`, naming the entries that matched, only when every finding that would have failed was exempt. An entry that cannot be parsed fails the check without exempting anything. `max-total` ignores this input. Approved records in `.compliance.vulnerability_exemptions.records[]` (written by the `vulnerability-exemptions` collector) also exempt findings that have no fix, read at run time, alongside this input.
`max_total_threshold`	Required	—	Maximum total findings allowed (must be configured)

Container Scan Guardrails

This guardrail is part of the Container Scan Guardrails policy, which includes 4 guardrails for security and compliance.

View Policy

Ready to Automate Your Standards?

See how Lunar can turn your AGENTS.md, engineering wiki, compliance docs, or postmortem action items into automated guardrails with our 300+ built-in guardrails.

Works with any process

AI agent rules & prompt files

Post-mortem action items

Security & compliance policies

Testing & quality requirements

Auto-ID My Guardrails

Paste your AGENTS.md or manual process doc and get guardrails in minutes

Book a Demo