Tenable Enclave Security Tenable Container Security System Requirements

For more information about Tenable Enclave Security system requirements, see Tenable Enclave Security System Requirements.

This page describes the system requirements for Tenable Container Security services, Tenable Container Security agents, and self-hosted and cloud databases.

Requirements for Tenable Container Security Services

Tenable Container Security Version	Service Name	# of Assets Managed by Tenable Container Security	CPU per pod	Memory per pod
1.8.x	tes-consec-ui	1 to 25,000 images	2 cores	2 GiB
	tes-consec-api	1 to 25,000 images	2 cores	3 GiB
	tes-consec-tvdl	1 to 25,000 images	2 cores	6 GiB
	tes-consec-policy	1 to 25,000 images	2 cores	2 GiB
	tes-consec-scan	1 to 25,000 images	2 cores	5 GiB
	tes-exposure-response	1 to 25,000 images	2 cores	2 GiB
	tes-platform-ui	1 to 25,000 images	2 cores	4 GiB
1.7.x	tes-consec-ui	1 to 25,000 images	2 cores	2 GiB
	tes-consec-api	1 to 25,000 images	2 cores	3 GiB
	tes-consec-tvdl	1 to 25,000 images	2 cores	10 GiB
	tes-consec-policy	1 to 25,000 images	2 cores	2 GiB
	tes-consec-scan	1 to 25,000 images	2 cores	5 GiB
	tes-exposure-response	1 to 25,000 images	2 cores	2 GiB
	tes-platform-ui	1 to 25,000 images	2 cores	4 GiB
1.6.x and earlier	tes-consec-ui	1 to 25,000 images	4000 m	4 GiB
	tes-consec-api	1 to 25,000 images	4000 m	6 GiB
	tes-consec-tvdl	1 to 25,000 images	4000 m	15 GiB
	tes-consec-policy	1 to 25,000 images	4000 m	6 GiB
	tes-consec-scan	1 to 25,000 images	4000 m	10 GiB

Tenable Container Security Agent Requirements

Caution: Do not run other scanners, such as Tenable Nessus, Tenable One Web App Scanning, or other vulnerability assessment tools, on the same instance. These tools are CPU and memory intensive and can cause resource contention. To handle multiple scans concurrently, deploy separate scanner instances rather than sharing resources.

Resource	Recommendation
CPU Note: This is a fixed requirement. You must provide additional cores only if you run multiple scanners in parallel.	4 cores
Memory (RAM)	8 GB minimum -or- equal to the largest uncompressed layer
Storage Note: This requirement accounts for the scanner, temporary layers, and other essential files.	50 GB minimum -or- Total compressed image size + uncompressed size of the largest layer Note: The agent downloads and temporarily extracts image layers under `/tmp/tes-consec/` on the host running the scan. If you mount dedicated storage, target `/tmp/tes-consec/` or the partition containing `/tmp`. All compressed layers remain on disk for the duration of the scan. Layers are decompressed one at a time and cleaned up before the next begins, so the extra headroom only needs to cover the single largest layer's uncompressed size. For example, an image with 1.5 GB of total compressed layers where the largest layer decompresses to 800 MB requires approximately 2.3 GB free on `/tmp/tes-consec/`.

Resource

Recommendation

CPU

Note: This is a fixed requirement. You must provide additional cores only if you run multiple scanners in parallel.

4 cores

Memory (RAM)

8 GB minimum

-or-

equal to the largest uncompressed layer

Storage

Note: This requirement accounts for the scanner, temporary layers, and other essential files.

50 GB minimum

-or-

Total compressed image size + uncompressed size of the largest layer

Note: The agent downloads and temporarily extracts image layers under /tmp/tes-consec/ on the host running the scan. If you mount dedicated storage, target /tmp/tes-consec/ or the partition containing /tmp. All compressed layers remain on disk for the duration of the scan. Layers are decompressed one at a time and cleaned up before the next begins, so the extra headroom only needs to cover the single largest layer's uncompressed size. For example, an image with 1.5 GB of total compressed layers where the largest layer decompresses to 800 MB requires approximately 2.3 GB free on /tmp/tes-consec/.

Database Changes in Tenable Container Security 1.6

Beginning in version 1.6, Tenable Container Security uses the database only and does not provision Persistent Volume Claims (PVC). When you upgrade to version 1.6, your existing data will be migrated from the PVC to the database.

The following are considerations for upgrading to Tenable Container Security 1.6:

If the migration succeeds, the existing PVC will be deleted after 30 days.
If the migration fails, the PVC will be deleted after 60 days. The data on the PVC will be recreated in the database when you run your first full scan after upgrading.
There is no impact to Tenable Container Security features if the migration fails. The first full scan may run slower.
Tenable Container Security 1.6 does not support database restore from database backups of previous Tenable Container Security versions.

Note: Tenable does not recommend doing a helm rollback to a previous Tenable Container Security release after upgrading to version 1.6. This can cause data drift, as previous versions use PVCs for scan data storage.

Self-Hosted Database Requirements

A self-hosted database is a database that you install and manage on your physical server or virtual machine. For example, PostgreSQL on a local server.

Requirements for Tenable Container Security self-hosted database

# of Assets Managed by Tenable Container Security	CPU	Memory	Disk Space
1 to 1,000 images	2000 m	16 GiB	10 GB
1,001 to 5,000 images	4000 m	32 GiB	15 GB
5,001 to 25,000 images	8000 m	64 GiB	20 GB

Cloud Database Requirements

A cloud database is a database service that is hosted and managed on a cloud platform. For example, AWS, Azure, or GCloud.

Requirements for Tenable Container Security database in AWS

# of Assets Managed by Tenable Container Security	Managed DB Instance Type	Compute Instance Type (Self-Managed)	CPU Cores	Memory	Storage
1 to 1,000 images	db.m6g.xlarge	db.m6g.xlarge	4	16 GiB	10 GB
1,001 to 5,000 images	db.m6g.2xlarge	m6g.2xlarge	8	32 GiB	15 GB
5,001 to 25,000 images	db.m6g.4xlarge	m6g.4xlarge	16	64 GiB	20 GB

Requirements for Tenable Container Security database in Azure for PostgreSQL flexible servers

# of Assets Managed by Tenable Container Security	Managed DB Instance Type	Compute Instance Type (Self-Managed)	CPU Cores	Memory	Storage
1 to 1,000 images	E2s_v3/E2ds_v4	D4s_v3	4	16 GiB	10 GB
1,001 to 5,000 images	E4s_v3/E4ds_v4	D16s_v3	8	32 GiB	15 GB
5,001 to 25,000 images	E8s_v3/E8ds_v4	D32s_v3	16	64 GiB	20 GB

Requirements for Tenable Container Security database in GCloud

# of Assets Managed by Tenable Container Security	Managed DB Instance Type	Compute Instance Type (Self-Managed)	CPU Cores	Memory	Storage
1 to 1,000 images	4 vCPU, 16GB	t2a-standard-4	4	16 GiB	10 GB
1,001 to 5,000 images	8 vCPU, 32GB	t2a-standard-8	8	32 GiB	15 GB
5,001 to 25,000 images	16 vCPU, 64GB	t2a-standard-16	16	64 GiB	20 GB