With the latest Docker Desktop 4.17 release, the Docker team introduced Docker Scout. Docker Scout is a collection of software supply chain features that appear throughout Docker user interfaces and the command line interface (CLI). These features provide detailed insights into the composition and security of container images.
How is Docker Scout different from other security tools?
There are various security tools available today in the market. While there are similarities and differences between all tools of this nature, Docker Scout stands out by offering both visibility into the dependencies called in specific layers of the images, and remediation options directly in existing developer workflows. Particularly, Advanced image analysis not only lets you analyze the vulnerabilities in your dependencies but also provides you with remediation options that help you to act quickly.
If a vulnerability is present in the base image, Docker Scout will check for any updated or patched base images and make recommendations to replace the base image. If a vulnerability is present in other layers, Docker Scout will indicate exactly where the vulnerability is introduced, and make recommendations accordingly.
Docker Scout is designed with developers in mind and integrated into Docker. With Docker Scout, spend less time searching for and fixing vulnerabilities, and more time developing your code. Docker is building Docker Scout to sit as a layer on top of the Docker ecosystem to help developers build and maintain a secure software supply chain. Right now, Docker is focussed on helping with vulnerability remediation; we think our CVE-to-package matching (using PURLs to help avoid false positives) and our SBOM-to-CVEdb matching (no need to rescan) are both nice improvements to the current Developer experience.
What problem does it solve?
- In-Context Remediation Recommendations
- Understanding your applications’ dependencies & analyzing the vulnerabilities
- Unified view into software composition analysis
- Artifactory Integration
- Event-driven vulnerability updates
1. In-context Remediation recommendations
Docker Scout analyzes the image contents and generates a detailed report of packages and vulnerabilities that it detects. It provides you with suggestions for how you can remediate issues discovered by the image analysis. It also allows you to get base image updates and recommended tags and digests, and filter your images on vulnerability information.
2. Understanding your applications’ dependencies & analyzing the vulnerabilities
Docker Scout helps you to understand your applications’ dependencies in each layer of your images, whether they’re in your base image or your application code. You can now assess the vulnerabilities presented in each dependency by layer, prioritized by severity.
3. Unified view into software composition analysis
With one view, your application’s direct and transitive dependencies from all layers are visible. This layer-based view not only makes remediation next steps clear, it also builds understanding of image composition.
4. Artifactory Integration
Docker Scout allows you to pull and view analysis for images from Docker Hub and Artifactory repositories. Integrating Docker Scout with JFrog Artifactory lets you run image analysis automatically on images in your Artifactory registries. This integration is made possible by a monitoring agent. The agent is a standalone service that analyzes images and uploads the result to Docker Scout. You can view the results using the Docker Scout web UI.
5. Event-driven vulnerability updates
Powered with Docker Scout, vulnerabilities are detected and surfaced on a continuous basis by the event-driven data model. When a new CVE is released, Docker Scout uses your image’s SBOM to check whether there’s a positive correlation between your image and your CVE – so your recommendations are always up to date.
Please note that Docker Scout is an early-access product, and requires a Pro, Team, or Business subscription.
Getting Started with Docker Scout
- Docker Desktop 4.17
- Requires a Pro, Team, or Business subscription
- Enable Docker Scout on Docker Hub
Enabling Docker Scout on Docker Hub
- Login to https://hub.docker.com
- Choose the organization that contains the repository with the image(s) you want to analyse.
- Select a repo, and open the "Settings" tab.
- Under "Image insight settings", choose "Advanced image analysis with Docker Scout."
- View your image analysis.
Command Line Tool for Docker Scout
Using the CLI, you can analyze images and view the analysis report in text format. You can print the results directly to stdout, or export them to a file using a structured format, such as Static Analysis Results Interchange Format (SARIF).
docker scout Usage: docker scout COMMAND Command line tool for Docker Scout Commands: cves Display CVEs identified in a software artifact version Show Docker Scout version information Run 'docker scout COMMAND --help' for more information on a command.
Checking the Version
docker scout version version: v0.6.0 (go1.19.5 - darwin/arm64) git commit: aabe2bfd192f7ac8cbfa4afea647b4dc41d3d30d
Displaying CVEs identified in a Software artifact
docker scout cves command analyzes a software artifact for vulnerabilities. The tool analyzes the provided software artifact, and generates a vulnerability report.
Usage: docker scout cves [OPTIONS] IMAGE|DIRECTORY|ARCHIVE
Supported Artifacts Types
The following artifact types are supported:
- OCI layout directories
- Tarball archives, as created by docker save
The tool analyzes the provided software artifact and generates a vulnerability report. By default, the tool expects an image reference, such as:
If the artifact you want to analyze is an OCI directory or a tarball archive, you must use the --type flag.
Display vulnerabilities grouped by package
docker scout cves redis Analyzing image redis ✓ Pulled ✓ Image stored for indexing ✓ Indexed 144 packages ✗ Detected 19 vulnerable packages with a total of 56 vulnerabilities 0C 16H 4M 1L stdlib 1.18.2 pkg:firstname.lastname@example.org ✗ HIGH CVE-2022-30580 [Improper Control of Generation of Code ('Code Injection')] https://dso.docker.com/cve/CVE-2022-30580 Affected range : >=1.18.0 : <1.18.3 Fixed version : 1.18.3 CVSS Score : 7.8 CVSS Vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H ... ... The image contains 19 packages with one or more vulnerabilities for a total of 50 vulnerabilities LOW | 28 MEDIUM | 4 HIGH | 18 CRITICAL | 0
Display vulnerabilities from a docker save tarball
$ docker save redis > redis.tar
docker scout cves --type archive redis.tar Analyzing archive redis.tar ✓ Archive read ✓ Image stored for indexing ✓ Indexed 144 packages ✗ Detected 19 vulnerable packages with a total of 56 vulnerabilities 0C 16H 4M 1L stdlib 1.18.2 pkg:email@example.com ✗ HIGH CVE-2022-30580 [Improper Control of Generation of Code ('Code Injection')] https://dso.docker.com/cve/CVE-2022-30580 Affected range : >=1.18.0 : <1.18.3 Fixed version : 1.18.3 CVSS Score : 7.8 CVSS Vector : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H .... ... The image contains 19 packages with one or more vulnerability for a total of 50 vulnerabilities LOW | 28 MEDIUM | 4 HIGH | 18 CRITICAL | 0
Display vulnerabilities from an OCI directory
$ skopeo copy --override-os linux docker://alpine oci:redis
The skopeo copy command you provided is used to copy container images from one container image registry to another. In this specific example, it is copying the alpine image that is built for the linux operating system from a Docker registry to an OCI image registry, and renaming it as redis.
Here is a breakdown of the command and its options:
- skopeo copy is the command for copying container images.
- --override-os linux specifies that the destination image should be built for the linux operating system, regardless of the source image's OS.
- docker://alpine specifies the source container image registry (docker) and the name of the source image (alpine).
- oci:redis specifies the destination container image registry (oci) and the new name for the copied image (redis).
In nutshell, this command will copy the alpine image to an OCI registry with the name redis, and ensure that the image is built for the linux operating system. Note that the resulting redis image may have a different size or configuration than the original alpine image, depending on the specific contents of the image and any changes made during the copy process.
skopeo copy --override-os linux docker://alpine oci:redis Getting image source signatures Copying blob af6eaf76a39c done Copying config 62aab729a2 done Writing manifest to image destination Storing signatures
docker scout cves --type oci-dir redis Analyzing OCI directory redis ✓ OCI directory read ✓ Image stored for indexing ✓ Indexed 19 packages ✓ No vulnerable package detected
Export vulnerabilities to a SARIF JSON file
$ docker scout cves --format sarif --output redis.sarif.json redis
Did you find this article valuable?
Support Collabnix by becoming a sponsor. Any amount is appreciated!