NIM Container Scanning - HiddenLayer Docs

NVIDIA NIM (NVIDIA Inference Microservice) containers bundle model-serving runtimes with metadata that points to external model artifacts on NVIDIA GPU Cloud (NGC). AI Supply Chain Security can scan a NIM container image to inspect embedded files and read its model manifest, but the referenced NGC artifacts must be downloaded and scanned separately.

Overview

A NIM container is an OCI image published to NVIDIA’s container registry (nvcr.io/nim/...). The container includes a model_manifest.yaml that describes deployment profiles and references model weight files stored on NGC using ngc:// URIs. Scanning the container itself is not the same as scanning the full model:

Container scan — Flattens the image, scans files inside the container filesystem, parses model_manifest.yaml, and emits an advisory with manifest evidence. External artifact URIs are collected into summary.referenced_models in v3 output.
Follow-up scan — Downloads referenced NGC artifacts out-of-band and scans the model files locally using Supply Chain CLI.

Model Manifest

During a NIM container scan, the scanner looks for model_manifest.yaml at:

opt/nim/etc/default/model_manifest.yaml (current layout)
etc/nim/config/model_manifest.yaml (legacy layout)

The manifest includes:

model — The default model identifier (for example, nvidia/test-model).
release — The model version.
profiles — Deployment profiles, each with a workspace section listing files and their ngc:// URIs.

Example manifest excerpt:

schema_version: '2.1'
model: nvidia/test-model
release: 1.0.0
profiles:
- id: profile-1
  workspace:
    files:
      model.bin:
        uri: ngc://nim/nvidia/test-model:1.0.0?file=model.bin
        checksum: blake3:abc123

Model Reference Advisory

NIM container scans emit advisory CONTAINER_0001_202606. This advisory indicates that the scanned input is a container with NIM runtime metadata. Review the manifest evidence and referenced model URIs before deploying the container. When the scanner parses the manifest, external artifact URIs from profile workspace files are also collected into summary.referenced_models in v3 JSON output. The list is deduplicated across all profiles. Example v3 summary excerpt:

"summary": {
  "file_count": 42,
  "referenced_models": [
    "ngc://nim/nvidia/test-model:1.0.0?file=model.bin"
  ]
}

These URIs identify NGC artifacts referenced by the container. They are not scanned automatically during the container scan — download them with the NGC CLI and scan them as part of the Model Reference remediation workflow.

For Model-Free Containers, the advisory is emitted, but referenced_models is empty as the manifest isn’t present in the container image.

​Overview

​Model Manifest

​Model Reference Advisory

Overview

Model Manifest

Model Reference Advisory