# NIM Container Scanning

NVIDIA NIM (NVIDIA Inference Microservice) containers bundle model-serving runtimes with metadata that points to external model artifacts on NVIDIA GPU Cloud (NGC). AI Supply Chain Security can scan a NIM container image to inspect embedded files and read its model manifest, but the referenced NGC artifacts must be downloaded and scanned separately.

## Overview

A NIM container is an OCI image published to NVIDIA's container registry (`nvcr.io/nim/...`). The container includes a `model_manifest.yaml` that describes deployment profiles and references model weight files stored on NGC using `ngc://` URIs.

Scanning the container itself is not the same as scanning the full model:

- [Container scan](/docs/products/supply-chain/cli/usage_examples#scan-a-nim-container) — Flattens the image, scans files inside the container filesystem, parses `model_manifest.yaml`, and emits an advisory with manifest evidence. External artifact URIs are collected into `summary.referenced_models` in v3 output.
- [Follow-up scan](/docs/products/supply-chain/cli/ngc_cli_download) — Downloads referenced NGC artifacts out-of-band and scans the model files locally using Supply Chain CLI.


## Model Manifest

During a NIM container scan, the scanner looks for `model_manifest.yaml` at:

- `opt/nim/etc/default/model_manifest.yaml` (current layout)
- `etc/nim/config/model_manifest.yaml` (legacy layout)


The manifest includes:

- **model** — The default model identifier (for example, `nvidia/test-model`).
- **release** — The model version.
- **profiles** — Deployment profiles, each with a **workspace** section listing files and their `ngc://` URIs.


Example manifest excerpt:

```
schema_version: '2.1'
model: nvidia/test-model
release: 1.0.0
profiles:
- id: profile-1
  workspace:
    files:
      model.bin:
        uri: ngc://nim/nvidia/test-model:1.0.0?file=model.bin
        checksum: blake3:abc123
```

## Model Reference Advisory

NIM container scans emit advisory **`CONTAINER_0001_202606`**. This advisory indicates that the scanned input is a container with NIM runtime metadata. Review the manifest evidence and referenced model URIs before deploying the container.

When the scanner parses the manifest, external artifact URIs from profile workspace files are also collected into **`summary.referenced_models`** in v3 JSON output. The list is deduplicated across all profiles.

Example v3 summary excerpt:

```
"summary": {
  "file_count": 42,
  "referenced_models": [
    "ngc://nim/nvidia/test-model:1.0.0?file=model.bin"
  ]
}
```

These URIs identify NGC artifacts referenced by the container. They are **not** scanned automatically during the container scan — [download them with the NGC CLI](/docs/products/supply-chain/cli/ngc_cli_download) and [scan them](/docs/products/supply-chain/cli/usage_examples#scanning-a-single-file) as part of the [Model Reference](/docs/products/supply-chain/remediation-guide/model_reference) remediation workflow.

For [Model-Free Containers](https://docs.nvidia.com/nim/large-language-models/latest/about-nim-llm/overview.html#model-free-and-model-specific-containers), the advisory is emitted, but `referenced_models` is empty as the manifest isn't present in the container image.