Docker Scout

Docker Scout — 镜像漏洞扫描与 SBOM

Guidance for vulnerability scanning, SBOM generation, and policy enforcement.

When to Use

ALWAYS use this skill when the user mentions:

• "docker scout", "镜像扫描", "漏洞扫描"
• "CVE", "vulnerability", "SBOM"
• "软件物料清单"
• "镜像安全分析", "image security scan"
• "policy evaluation"

Core Commands

# Quick vulnerability overview
docker scout quickview myimage:tag

# Detailed CVE report
docker scout cves --format table myimage:tag
docker scout cves --only-fixed myimage:tag   # Show only fixable CVEs
docker scout cves --severity critical,high myimage:tag

# SBOM (Software Bill of Materials)
docker scout sbom myimage:tag                # SPDX format
docker scout sbom --format cyclonedx myimage:tag  # CycloneDX format

# Compare two images
docker scout compare myimage:v1 --to myimage:v2

# Policy evaluation
docker scout policy myimage:tag

CVE Severity Levels

CI/CD Integration

GitHub Actions

- name: Docker Scout
  uses: docker/scout-action@v1
  with:
    command: cves,compare
    image: ${{ steps.meta.outputs.tags }}
    compare-to: registry/${{ env.IMAGE_NAME }}:latest

Remediation Workflow

1. docker scout cves myimage:tag → Identify CVEs
2. Check if fixable: --only-fixed shows which have patches
3. Update base image: FROM alpine:3.20 (newer version)
4. Update dependencies: npm update / pip install --upgrade / apt upgrade
5. Rebuild: docker build -t myimage:v2 .
6. Verify: docker scout compare myimage:v1 --to myimage:v2

Workflow — 推荐扫描流程

Step 1: 快速扫描: docker scout quickview <image> 获得 CVE 摘要 Step 2: 详细分析: docker scout cves --only-severity critical,high <image> Step 3: 查看建议: docker scout recommendations <image> 获取修复方案 Step 4: 修复重建: 更新基础镜像/依赖 → docker build → 再次扫描验证 Step 5: CI 集成: docker/scout-action + 策略门禁阻断

Gotchas — Common Pitfalls

• Scout vs scan: docker scan (Snyk-based, deprecated). → Recovery: Always use docker scout instead; uninstall old docker scan plugin.
• Only scanning, not fixing: Scout shows CVEs but doesn't fix them. → Recovery: docker scout recommendations <image> for fix suggestions; update base image or rebuild with newer dependencies.
• Base image CVEs: Many CVEs come from the base image. → Recovery: docker pull alpine:3.20 (update base); pin digest to avoid accidental downgrades; monitor with docker scout cves alpine:3.20.
• Multi-stage skip: Scanner needs access to both stages. → Recovery: Ensure all stage artifacts are COPY --from=... properly; tag intermediate stages if needed.

Boundary — 能力边界（适用与不适用场景）

When NOT to Use This Skill

Security & Stability

• Run Scout in CI/CD to catch vulnerabilities before deployment.
• Subscribe to Docker security advisories for zero-day notifications.
• No executable scripts bundled. Guidance only.

📚 官方文档参考

🧭 Docker Skills Journey

📍 You are here: docker-scout — 镜像安全扫描

← Prev: docker-security — Security hardening → Next: docker-hub — Registry management

FAQ

Q1: 如何快速上手此技能？ A: 参考上方的快速开始章节，按步骤操作即可。

Q2: 遇到版本不兼容问题怎么办？ A: 检查依赖版本，使用 lock 文件锁定，参考常见陷阱章节。

Q3: 如何在生产环境使用？ A: 参考最佳实践章节，确保配置正确，做好监控和日志。

Q4: 性能如何优化？ A: 参考性能优化相关文档，使用缓存、索引等手段。

Q5: 如何贡献或反馈问题？ A: 在 GitHub 仓库提交 Issue 或 Pull Request。

Q6: 是否支持中文？ A: 支持中文文档和中文注释，详见国内适配章节。