SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsdocker-scout

docker-scout

Deployment & operations

View repository

Updated 10-15 21:48

About this skill

Docker Scout — Image Vulnerability Scanning and SBOM

Guidance for vulnerability scanning, SBOM generation, and policy enforcement.

When to Use

ALWAYS use this skill when the user mentions:

  • "docker scout", "image scanning", "vulnerability scanning"
  • "CVE", "vulnerability", "SBOM"
  • "software bill of materials"
  • "image security analysis", "image security scan"
  • "policy evaluation"

Core Commands

# Quick vulnerability overview
docker scout quickview myimage:tag
Detailed CVE report

docker scout cves --format table myimage:tag docker scout cves --only-fixed myimage:tag # Show only fixable CVEs docker scout cves --severity critical,high myimage:tag

SBOM (Software Bill of Materials)

docker scout sbom myimage:tag # SPDX format docker scout sbom --format cyclonedx myimage:tag # CycloneDX format

Compare two images

docker scout compare myimage:v1 --to myimage:v2

Policy evaluation

docker scout policy myimage:tag


## CVE Severity Levels

| Level | Action |
|-------|--------|
| **Critical** | Fix immediately |
| **High** | Fix in current sprint |
| **Medium** | Schedule fix |
| **Low** | Monitor |
| **Unspecified** | Review |

## CI/CD Integration

### GitHub Actions

```yaml
- name: Docker Scout
  uses: docker/scout-action@v1
  with:
    command: cves,compare
    image: ${{ steps.meta.outputs.tags }}
    compare-to: registry/${{ env.IMAGE_NAME }}:latest

Remediation Workflow

1. docker scout cves myimage:tag → Identify CVEs
2. Check if fixable: --only-fixed shows which have patches
3. Update base image: FROM alpine:3.20 (newer version)
4. Update dependencies: npm update / pip install --upgrade / apt upgrade
5. Rebuild: docker build -t myimage:v2 .
6. Verify: docker scout compare myimage:v1 --to myimage:v2

Workflow — Recommended scanning process

Step 1: Quick scan: docker scout quickview <image> Get CVE summary Step 2: Detailed analysis: docker scout cves --only-severity critical,high <image> Step 3: View recommendations: docker scout recommendations <image> Get remediation plan Step 4: Fix and rebuild: update base image/dependencies → docker build → scan again to verify Step 5: CI integration: docker/scout-action + policy gate blocking

Gotchas — Common Pitfalls

  • Scout vs scan: docker scan (Snyk-based, deprecated). → Recovery: Always use docker scout instead; uninstall old docker scan plugin.
  • Only scanning, not fixing: Scout shows CVEs but doesn't fix them. → Recovery: docker scout recommendations <image> for fix suggestions; update base image or rebuild with newer dependencies.
  • Base image CVEs: Many CVEs come from the base image. → Recovery: docker pull alpine:3.20 (update base); pin digest to avoid accidental downgrades; monitor with docker scout cves alpine:3.20.
  • Multi-stage skip: Scanner needs access to both stages. → Recovery: Ensure all stage artifacts are COPY --from=... properly; tag intermediate stages if needed.

Boundary — Capability boundaries (applicable and non-applicable scenarios)

Category Scenario Description
✅ Can do CVE vulnerability scanning CLI: docker scout cves + quickview
✅ Can do SBOM generation docker scout sbom --format spdx
✅ Can do Policy evaluation and CI blocking policy evaluation + GitHub Actions
⚠️ Conditional Private repository scanning Requires Docker Scout subscription
⚠️ Conditional Cross-organization comparison Requires Scout Dashboard (Web UI)
❌ Out of scope Runtime security Use docker-security
❌ Out of scope Third-party scanners (Trivy/Grype) Each tool is used independently
❌ Out of scope Fixing vulnerabilities (updating dependencies) Completed by developers themselves

When NOT to Use This Skill

❌ Skip ✅ Use Instead
Runtime security (seccomp/AppArmor) docker-security
Building images docker-build
CI/CD pipeline setup docker-cicd
Registry management docker-hub

Security & Stability

  • Run Scout in CI/CD to catch vulnerabilities before deployment.
  • Subscribe to Docker security advisories for zero-day notifications.
  • No executable scripts bundled. Guidance only.

📚 Official documentation reference

Documentation Address
Docker Scout overview https://docs.docker.com/scout/
Scout quick start https://docs.docker.com/scout/quickstart/
Scout CLI reference https://docs.docker.com/reference/cli/docker/scout/
Policy evaluation https://docs.docker.com/scout/policy/
CI integration https://docs.docker.com/scout/integrations/ci/
SBOM management https://docs.docker.com/scout/explore/sbom/

🧭 Docker Skills Journey

📍 You are here: docker-scout — Image security scanning

← Prev: docker-security — Security hardening → Next: docker-hub — Registry management

FAQ

Q1: How do I quickly get started with this skill? A: Refer to the Quick Start section above and follow the steps.

Q2: What should I do if I encounter a version incompatibility issue? A: Check dependency versions, lock them with a lock file, and refer to the Common Pitfalls section.

Q3: How do I use it in a production environment? A: Refer to the Best Practices section, ensure the configuration is correct, and set up monitoring and logging.

Q4: How can performance be optimized? A: Refer to the performance optimization documentation and use caching, indexing, and other methods.

Q5: How can I contribute or provide feedback? A: Submit an Issue or Pull Request in the GitHub repository.

Q6: Is Chinese supported? A: Chinese documentation and Chinese comments are supported; see the Domestic Adaptation section for details.