Detection itself works very well: we pushed nginx:1.14.0 to a Docker feed, and ProGet correctly inventoried it — 108 packages, 66 with vulnerabilities, 521 real CVEs (via Ubuntu Security Notices).

We then escalated one of those findings to Contain (confirmed Noncompliant in the audit view), with Feeds.AllowNoncompliantDownloads set to false at the global level — the same setting that correctly blocks NuGet/npm/PyPI packages once they're assessed Noncompliant in our testing.

For the container image, though:

• A fresh docker pull of the same image from the source feed succeeded anyway.
• Promoting the same image to a second feed also succeeded.

Layer Scanning was already enabled on the feed. We re-tested this twice more to rule out a fluke: once by reconfirming the original image's assessment was still genuinely Contain and re-pulling (same result), and once on an entirely different image (httpd:2.4.29, 95 packages, 314 vulnerabilities) end-to-end (same result).

Is there a separate setting that governs blocking specifically for container/Docker feeds, distinct from AllowNoncompliantDownloads? Or is policy-based blocking for container images not yet supported the same way it is for package feeds on this version?
We want to make sure we're not missing a config option before we document this as a gap in our evaluation.

Thanks,
Sai