Contigov — Features & Capabilities

Contigov is a continuous Docker governance platform that gives security and IT teams full visibility and control over container workloads across every managed endpoint — Windows, macOS, and Linux — from a single web interface.

Table of Contents

1. Fleet Dashboard
2. Repository & Image Policy
3. Real-Time Enforcement
4. Vulnerability Scanning
5. AI Workload Detection
6. Audit Logs
7. Notifications & Alerts
8. Webhook Integrations
9. Authentication & Access Control
10. Single Sign-On (SSO / OIDC)
11. Multi-Factor Authentication (MFA)
12. Maintenance Mode
13. MCP Server — AI Assistant Integration
14. OX Security Integration
15. TLS & HTTPS
16. Health & Capacity Monitoring
17. Scale & Performance
18. Agent Capabilities

1. Fleet Dashboard

The dashboard provides a live, real-time view of every managed endpoint in the fleet. It is the central control point for everything — viewing containers, triggering scans, managing policy, and responding to incidents.

Four view modes

Per-endpoint cards

Each endpoint card displays in real time:

• Hostname, operating system, and online / offline status
• Agent version and last seen timestamp
• Running containers — name, image, status
• Local images — tag, size, vulnerability summary badge
• Maintenance mode badge with time remaining (when active)
• Action buttons — notify, pause enforcement, open details

Endpoint details drawer

Clicking any endpoint card opens a side drawer with the full endpoint profile:

• Complete container list with status, image, and CVE badge
• Full image inventory with one-click CVE modal per image
• Agent configuration summary
• Maintenance mode controls
• Remote action buttons (scan, stop container, send notification)

Dashboard filters

Filter the fleet in real time using the filter bar:

• Online / Offline — show only reachable or unreachable endpoints
• OS type — filter by Windows, macOS, or Linux
• Agent version — isolate endpoints running a specific agent version

Stable card positions

Endpoint cards maintain their position on every refresh. Only the inner content updates — cards never reorder or jump, making it easy to track a specific endpoint in a large fleet.

Offline endpoint handling

When an endpoint goes offline, its card remains visible with its last known state and an offline indicator. Data does not disappear — you can still see what was running before connectivity was lost.

Five UI themes

Dark · Light · Midnight · Cyber · Rust — selectable from the top navigation bar. Theme preference is saved per browser.

2. Repository & Image Policy

The Policy tab gives administrators full control over which container images and registries are permitted across the entire fleet.

Two operating modes

Pattern syntax

Docker Hub sub-domain auto-expansion

Blocking docker.io automatically also blocks all Docker Hub sub-domains used internally by the Docker daemon:

• registry-1.docker.io
• auth.docker.io
• index.docker.io
• hub.docker.com

Per-endpoint policy overrides

Administrators can grant a temporary or permanent exception for a specific image or registry pattern on a single endpoint — without changing the global policy. Use cases:

• Allow a developer to pull a specific image for testing while keeping the fleet blocked
• Permit a legacy workload on one machine that cannot be migrated yet

To grant an override: Policy → Policy Overrides → select endpoint → enter image/pattern → add justification → Grant Override.

Every override is logged in the audit trail. The affected endpoint receives a desktop notification. The exception takes effect within 5 seconds. Overrides can be revoked at any time from the dashboard or the Policy tab.

3. Real-Time Enforcement

Enforcement is performed locally on each endpoint by the agent — it does not depend on network connectivity to the server once policy has been received.

Hosts file enforcement

The agent rewrites the system hosts file on startup and every 60 seconds to redirect blocked registry hostnames to 127.0.0.1. This causes docker pull from blocked registries to fail immediately at the DNS level — before any network connection is made.

Only a clearly marked block managed by Contigov is written. All other hosts file entries are never touched.

Container enforcement

The agent subscribes to the Docker event stream. When a container starts, the agent immediately checks its image name against the current block list. If matched, the agent calls docker stop -t 0 — the container is stopped in under one second. The event is logged as ENFORCEMENT_TRIGGERED in the audit log and the endpoint user receives a desktop notification.

Pull-attempt interception

The agent listens on 127.0.0.1:443. When a docker pull is attempted to a blocked registry, the TCP connection hits the redirected IP and the agent reads the TLS SNI hostname. It logs the event as PULL_ATTEMPT_BLOCKED, reports it to the server, and sends a real-time desktop notification to the user — all within milliseconds.

Enforcement during server outage

Policy is cached in the agent’s memory. If the server is temporarily unreachable, enforcement continues using the last known policy. The system does not fail open.

4. Vulnerability Scanning

Every image discovered on a managed endpoint is automatically scanned for known CVEs using Trivy (Aqua Security’s open-source scanner).

How it works

• Trivy is downloaded automatically by the agent on first run — no manual installation required on endpoints
• Each image is scanned on first discovery, when its digest changes, or when manually triggered from the dashboard
• Scan results are uploaded to the server and displayed in the web UI immediately

Results display

For each scanned image the UI shows:

• CVE severity breakdown — CRITICAL · HIGH · MEDIUM · LOW · UNKNOWN counts
• Per-CVE detail — CVE ID, affected package, installed version, fixed version, and severity
• Visual badges on endpoint cards and the endpoint details drawer

Export options

• Per-image CSV export — download the full CVE list for a single image
• Fleet-wide CSV export — download all scan results across all endpoints in one file

Scan triggers

Notifications on scan completion

• If CRITICAL CVEs are found, the critical_cve notification rule fires automatically (if enabled)
• The scan.critical webhook event fires on all configured webhook destinations

5. AI Workload Detection

The AI Index automatically identifies containers and images that are running AI-related workloads — large language model runners, machine learning frameworks, GPU toolkits, and Model Context Protocol (MCP) servers.

Detection logic

Container image names and container names are matched against a continuously maintained pattern library. Matching categories include:

• LLM runners — Ollama, LM Studio, llama.cpp, GPT4All, LocalAI, vLLM, text-generation-webui
• ML frameworks — TensorFlow, PyTorch, Hugging Face Transformers, JAX, ONNX Runtime
• GPU toolkits — NVIDIA CUDA, cuDNN, TensorRT, ROCm
• MCP servers — containers exposing Model Context Protocol endpoints
• AI development tools — JupyterLab, Jupyter Notebook, MLflow, Ray, Kubeflow

AI Index view

A dedicated AI Index tab shows all endpoints that have at least one AI-flagged container or image. For each endpoint it shows:

• Which containers or images triggered the AI flag and the detected category
• Online / offline status
• Last seen timestamp

The AI Index refreshes every 60 seconds and immediately on tab switch.

6. Audit Logs

Every governance action performed by any user, agent, or automated rule is recorded in the audit log with full context.

What is logged

Each log entry contains

• Timestamp (UTC)
• Acting user (or “agent” for automated events)
• Affected endpoint hostname
• Event type and human-readable description
• Correlation ID — unique per HTTP request, links all log lines from the same action
• Source IP address

Search and filter

• Full-text search across all fields
• Filter by event type
• Filter by endpoint
• Export full log to CSV

7. Notifications & Alerts

Predefined notification rules

Toggle event-driven rules on or off from the Notifications tab. When a rule fires, a desktop notification is sent to the relevant endpoint.

Custom notifications

Admins can send a custom message to a specific endpoint or broadcast to all active endpoints directly from the dashboard — useful for announcements, warnings, or incident communication.

Desktop notification appearance

• Windows — Toast notifications with the Contigov app name and icon. A Start Menu shortcut is created automatically on first run to enable the custom application ID.
• macOS — System notification center alerts
• Linux — libnotify / notify-send desktop notifications

8. Webhook Integrations

The built-in webhook engine pushes real-time event payloads to any external system when governance events occur. No third-party plugin required.

Supported platforms

Subscribable events

Each webhook can subscribe to any combination of events, or leave all unchecked to receive every event. Use the Test button to verify delivery before going live.

9. Authentication & Access Control

Role-based access control (RBAC)

Session security

• httpOnly cookies — JWT session tokens are stored as httpOnly, Secure, SameSite=Strict cookies. They are never accessible to JavaScript, eliminating XSS-based token theft.
• Persistent token revocation — on logout the token’s unique JTI claim is written to the database. Revoked tokens remain invalid across container restarts and server reboots. The revocation list is replayed from the database into memory on every startup.
• Session idle timeout — configurable auto-logout after inactivity (minimum 1 minute, maximum 480 minutes). A warning modal appears 60 seconds before expiry allowing the user to extend the session.

User management

From Settings → Users, administrators can:

• View all accounts with role badges and last login timestamps
• Create new accounts with admin or user role
• Delete accounts
• Change their own password
• Enable or disable MFA per account

10. Single Sign-On (SSO / OIDC)

Contigov supports any OIDC-compliant identity provider using the Authorization Code + PKCE flow — no library dependencies, built on native Node.js crypto and fetch.

Supported providers

• Microsoft Entra ID (Azure AD)
• Okta
• Google Workspace
• Keycloak
• Any OIDC-compliant provider with a discovery document

Configuration

Configure from Settings → Users → Single Sign-On:

• Provider label (shown on the login button)
• Client ID and Client Secret
• Discovery URL (e.g. https://login.microsoftonline.com/<tenant-id>/v2.0/.well-known/openid-configuration)
• Allowed Group Object ID — restrict login to members of a specific group
• Admin Group Object ID — automatically assign the admin role to members of a specific group

User provisioning

• Accounts are created automatically on first SSO login
• Role is assigned based on group membership (if group IDs are configured)
• Subsequent logins update the last-seen timestamp — no manual account creation required

11. Multi-Factor Authentication (MFA)

TOTP-based MFA is available for all local accounts and is compatible with any RFC 6238 authenticator app.

Compatible apps

• Google Authenticator
• Microsoft Authenticator
• Authy
• 1Password
• Any TOTP-compatible app

Setup

1. Go to Settings → Users → Two-Factor Authentication
2. Click Set Up MFA — scan the QR code with your authenticator app
3. Enter the 6-digit code to confirm and activate
4. On future logins, after entering your password you will be prompted for the TOTP code

Security

• MFA TOTP verification is rate-limited to 10 attempts per 10 minutes per IP to prevent brute-force attacks on the 6-digit code
• To disable MFA, the current password and a valid TOTP code are both required

12. Maintenance Mode

Administrators can temporarily suspend policy enforcement on a specific endpoint for a defined period — useful for debugging, testing, or planned maintenance without affecting the rest of the fleet.

How it works

1. Click the pause button on an endpoint card (admin only)
2. Select the duration (15 minutes, 30 minutes, 1 hour, 2 hours, or custom)
3. The server sets a maintenance_until timestamp for that endpoint
4. On the next agent report cycle the agent receives the maintenance status and immediately clears all hosts file blocks for that endpoint
5. All enforcement is suspended until the timer expires or an admin resumes enforcement manually
6. When the timer expires, full enforcement is automatically restored

Visual indicators

• A Maintenance badge appears on the endpoint card showing the time remaining
• A resume button (▶) replaces the pause button while maintenance is active
• All maintenance events are logged in the audit trail

13. MCP Server — AI Assistant Integration

Contigov includes a built-in Model Context Protocol (MCP) server that lets AI coding assistants query your fleet and manage policy using natural language — no custom scripts or API knowledge required.

Compatible AI assistants

• Cursor IDE
• Claude Desktop
• GitHub Copilot (MCP-compatible versions)
• Any MCP-compatible HTTP client

What you can do

Ask your AI assistant natural language questions such as:

• “Show me all online endpoints and their running containers”
• “Which endpoints have CRITICAL vulnerabilities?”
• “Block the image nginx:1.19 across the fleet”
• “What is the current policy?”
• “Show me the last 20 audit log entries”
• “Which endpoints are running AI containers?”

Available MCP tools

Enable the MCP server and configure connections from Settings → Integrations → MCP Server.

14. OX Security Integration

Contigov integrates with OX Security‘s Application Security Posture Management (ASPM) platform. Container vulnerability scan results are automatically pushed to OX after each Trivy scan, giving you a unified view of container security posture alongside your application security findings.

Setup

1. Go to Settings → Integrations → OX Security
2. Toggle the integration on
3. Enter your OX Security API Key and API URL
4. Click Test Connection to verify
5. Click Sync Findings Now for an immediate push of all current scan results

After initial setup, findings are pushed automatically after every scan without any further manual action.

15. TLS & HTTPS

Contigov is HTTPS-first out of the box. Three TLS modes cover every deployment scenario from local evaluation to enterprise production.

Certificate management

• The Security settings page automatically reads and displays the active certificate — Common Name, SANs, issuer, valid dates, and an expiry countdown bar that turns amber when under 30 days and red when expired
• HSTS is enforced via Helmet — browsers lock to HTTPS after the first visit
• Custom certificates are mounted as a Docker volume — no image rebuild required

16. Health & Capacity Monitoring

The Monitoring section (Settings → Monitoring, admin only) gives a live view of every server performance metric with automatic threshold warnings and recommendations.

• Each gauge turns yellow at the warning threshold and red at the critical threshold
• A banner with a specific recommended action appears when any metric enters a warn or critical state
• When any metric enters critical state, all configured webhooks automatically fire with event type threshold.critical
• Auto-refreshes every 15 seconds with a manual refresh button
• Prometheus-compatible metrics endpoint at /metrics for integration with Grafana and alerting pipelines

17. Scale & Performance

18. Agent Capabilities

The agent is a statically compiled Go binary — no runtime, no installer, no dependencies. It runs natively on every major platform.