A First Look at Docker Scout — A Software Supply Chain Security for Developers

5 min readFeb 28, 2023

With the latest Docker Desktop 4.17 release, the Docker team introduced Docker Scout. Docker Scout is a collection of software supply chain features that appear throughout Docker user interfaces and the command line interface (CLI). These features provide detailed insights into the composition and security of container images.

How is Docker Scout different from other security tools?

There are various security tools available today in the market. While there are similarities and differences between all tools of this nature, Docker Scout stands out by offering both visibility into the dependencies called in specific layers of the images, and remediation options directly in existing developer workflows. Particularly, Advanced image analysis not only lets you analyze the vulnerabilities in your dependencies but also provides you with remediation options that help you to act quickly.

If a vulnerability is present in the base image, Docker Scout will check for any updated or patched base images and make recommendations to replace the base image. If a vulnerability is present in other layers, Docker Scout will indicate exactly where the vulnerability is introduced, and make recommendations accordingly.

Docker Scout is designed with developers in mind and integrated into Docker. With Docker Scout, spend less time searching for and fixing vulnerabilities, and more time developing your code. Docker is building Docker Scout to sit as a layer on top of the Docker ecosystem to help developers build and maintain a secure software supply chain. Right now, Docker is focussed on helping with vulnerability remediation; we think our CVE-to-package matching (using PURLs to help avoid false positives) and our SBOM-to-CVEdb matching (no need to rescan) are both nice improvements to the current Developer experience.

What problem does it solve?

1. Image Content Analysis

Docker Scout analyzes the image contents and generates a detailed report of packages and vulnerabilities that it detects. It provides you with suggestions for how you can remediate issues discovered by the image analysis. It also allows you to get base image updates and recommended tags and digests, and filter your images on vulnerability information.

2. Artifactory Integration

Docker Scout allows you to pull and view analysis for images from Docker Hub and Artifactory repositories. Integrating Docker Scout with JFrog Artifactory lets you run image analysis automatically on images in your Artifactory registries. This integration is made possible by a monitoring agent. The agent is a standalone service that analyzes images and uploads the result to Docker Scout. You can view the results using the Docker Scout web UI.

It also allows you to get base image updates and recommended tags and digests, and filter your images on vulnerability information.

Please note that Docker Scout is an early-access product, and requires a Pro, Team, or Business subscription.

Getting Started with Docker Scout

Pre-requisites

Docker Desktop 4.17
Requires a Pro, Team, or Business subscription
Enable Docker Scout on Docker Hub

Enabling Docker Scout on Docker Hub

Login to https://hub.docker.com
Choose the organization that contains the repository with the image(s) you want to analyse.
Select a repo, and open the “Settings” tab.
Under “Image insight settings”, choose “Advanced image analysis with Docker Scout.”
View your image analysis.

Command Line Tool for Docker Scout

Using the CLI, you can analyze images and view the analysis report in text format. You can print the results directly to stdout, or export them to a file using a structured format, such as Static Analysis Results Interchange Format (SARIF).

docker scout

Usage:  docker scout COMMANDCommand line tool for Docker ScoutCommands:
  cves        Display CVEs identified in a software artifact
  version     Show Docker Scout version informationRun 'docker scout COMMAND --help' for more information on a command.

Checking the Version

docker scout version
version: v0.6.0 (go1.19.5 - darwin/arm64)
git commit: aabe2bfd192f7ac8cbfa4afea647b4dc41d3d30d

Displaying CVEs identified in a Software artifact

The docker scout cves command analyzes a software artifact for vulnerabilities. The tool analyzes the provided software artifact, and generates a vulnerability report.

Usage:  docker scout cves [OPTIONS] IMAGE|DIRECTORY|ARCHIVE

Supported Artifacts Types

The following artifact types are supported:

Images
OCI layout directories
Tarball archives, as created by docker save

Images

The tool analyzes the provided software artifact and generates a vulnerability report. By default, the tool expects an image reference, such as:

redis
curlimages/curl:7.87.0
mcr.microsoft.com/dotnet/runtime:7.0

If the artifact you want to analyze is an OCI directory or a tarball archive, you must use the — type flag.

Examples:

Display vulnerabilities grouped by package

docker scout cves redis
Analyzing image redis
    ✓ Pulled
    ✓ Image stored for indexing
    ✓ Indexed 144 packages
    ✗ Detected 19 vulnerable packages with a total of 56 vulnerabilities

  0C   16H    4M    1L  stdlib 1.18.2
pkg:golang/stdlib@1.18.2    ✗ HIGH CVE-2022-30580 [Improper Control of Generation of Code ('Code Injection')]
      https://dso.docker.com/cve/CVE-2022-30580
      Affected range : >=1.18.0
                     : <1.18.3
      Fixed version  : 1.18.3
      CVSS Score     : 7.8
      CVSS Vector    : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
...
...
The image contains 19 packages with one or more vulnerabilities for a total of 50 vulnerabilities
  LOW      | 28
  MEDIUM   | 4
  HIGH     | 18
  CRITICAL | 0

Display vulnerabilities from a docker save tarball

$ docker save redis > redis.tar

docker scout cves --type archive redis.tar
Analyzing archive redis.tar
    ✓ Archive read
    ✓ Image stored for indexing
    ✓ Indexed 144 packages
    ✗ Detected 19 vulnerable packages with a total of 56 vulnerabilities

  0C   16H    4M    1L  stdlib 1.18.2
pkg:golang/stdlib@1.18.2    ✗ HIGH CVE-2022-30580 [Improper Control of Generation of Code ('Code Injection')]
      https://dso.docker.com/cve/CVE-2022-30580
      Affected range : >=1.18.0
                     : <1.18.3
      Fixed version  : 1.18.3
      CVSS Score     : 7.8
      CVSS Vector    : CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
....
...
The image contains 19 packages with one or more vulnerability for a total of 50 vulnerabilities
  LOW      | 28
  MEDIUM   | 4
  HIGH     | 18
  CRITICAL | 0

Display vulnerabilities from an OCI directory

$ skopeo copy --override-os linux docker://alpine oci:redis

skopeo copy --override-os linux docker://alpine oci:redis
Getting image source signatures
Copying blob af6eaf76a39c done
Copying config 62aab729a2 done
Writing manifest to image destination
Storing signatures

docker scout cves --type oci-dir redis 
Analyzing OCI directory redis
    ✓ OCI directory read
    ✓ Image stored for indexing
    ✓ Indexed 19 packages
    ✓ No vulnerable package detected

Export vulnerabilities to a SARIF JSON file

$ docker scout cves --format sarif --output redis.sarif.json redi