Docker Scout

Docker Scout — 镜像漏洞扫描与 SBOM

Guidance for vulnerability scanning, SBOM generation, and policy enforcement.

When to Use

ALWAYS use this skill when the user mentions:

• "docker scout", "镜像扫描", "漏洞扫描"
• "CVE", "vulnerability", "SBOM"
• "软件物料清单"
• "镜像安全分析", "image security scan"
• "policy evaluation"

Core Commands

# Quick vulnerability overview
docker scout quickview myimage:tag

# Detailed CVE report
docker scout cves --format table myimage:tag
docker scout cves --only-fixed myimage:tag   # Show only fixable CVEs
docker scout cves --severity critical,high myimage:tag

# SBOM (Software Bill of Materials)
docker scout sbom myimage:tag                # SPDX format
docker scout sbom --format cyclonedx myimage:tag  # CycloneDX format

# Compare two images
docker scout compare myimage:v1 --to myimage:v2

# Policy evaluation
docker scout policy myimage:tag

CVE Severity Levels

CI/CD Integration

GitHub Actions

- name: Docker Scout
  uses: docker/scout-action@v1
  with:
    command: cves,compare
    image: ${{ steps.meta.outputs.tags }}
    compare-to: registry/${{ env.IMAGE_NAME }}:latest

Remediation Workflow

1. docker scout cves myimage:tag → Identify CVEs
2. Check if fixable: --only-fixed shows which have patches
3. Update base image: FROM alpine:3.20 (newer version)
4. Update dependencies: npm update / pip install --upgrade / apt upgrade
5. Rebuild: docker build -t myimage:v2 .
6. Verify: docker scout compare myimage:v1 --to myimage:v2

Workflow — 推荐扫描流程

Step 1: 快速扫描: docker scout quickview <image> 获得 CVE 摘要 Step 2: 详细分析: docker scout cves --only-severity critical,high <image> Step 3: 查看建议: docker scout recommendations <image> 获取修复方案 Step 4: 修复重建: 更新基础镜像/依赖 → docker build → 再次扫描验证 Step 5: CI 集成: docker/scout-action + 策略门禁阻断

Gotchas — Common Pitfalls

• Scout vs scan: docker scan (Snyk-based, deprecated). → Recovery: Always use docker scout instead; uninstall old docker scan plugin.
• Only scanning, not fixing: Scout shows CVEs but doesn't fix them. → Recovery: docker scout recommendations <image> for fix suggestions; update base image or rebuild with newer dependencies.
• Base image CVEs: Many CVEs come from the base image. → Recovery: docker pull alpine:3.20 (update base); pin digest to avoid accidental downgrades; monitor with docker scout cves alpine:3.20.
• Multi-stage skip: Scanner needs access to both stages. → Recovery: Ensure all stage artifacts are COPY --from=... properly; tag intermediate stages if needed.

Boundary — 能力边界（适用与不适用场景）

When NOT to Use This Skill

Security & Stability

• Run Scout in CI/CD to catch vulnerabilities before deployment.
• Subscribe to Docker security advisories for zero-day notifications.
• No executable scripts bundled. Guidance only.

📚 官方文档参考

🧭 Docker Skills Journey

📍 You are here: `docker-scout` — 镜像安全扫描

← Prev: docker-security — Security hardening → Next: docker-hub — Registry management

FAQ

Q1: 如何快速上手此技能？ A: 参考上方的快速开始章节，按步骤操作即可。

Q2: 遇到版本不兼容问题怎么办？ A: 检查依赖版本，使用 lock 文件锁定，参考常见陷阱章节。

Q3: 如何在生产环境使用？ A: 参考最佳实践章节，确保配置正确，做好监控和日志。

Q4: 性能如何优化？ A: 参考性能优化相关文档，使用缓存、索引等手段。

Q5: 如何贡献或反馈问题？ A: 在 GitHub 仓库提交 Issue 或 Pull Request。

Q6: 是否支持中文？ A: 支持中文文档和中文注释，详见国内适配章节。

快速漏洞扫描

# 扫描当前镜像
docker scout quickview nginx:1.27-alpine

# 输出：
# ✓ SBOM of image already cached, 228 packages indexed
#
#   Target  │  nginx:1.27-alpine  │    0C     0H     0M     0L
#     digest│  abc123...          │
#
#   What's next:
#     View detailed results → docker scout cves nginx:1.27-alpine

查看 CVE 详情

docker scout cves nginx:1.27-alpine

# 输出：
#    0C     0H     0M     1L  nginx:1.27-alpine
#
#    ✗ LOW CVE-2024-12345 [OWASP Top Ten]
#      https://scout.docker.com/v/CVE-2024-12345
#      Affected range: <1.27.1
#      Fixed version : 1.27.1

查看推荐

docker scout recommendations nginx:1.27-alpine

# 输出建议：
# - 升级基础镜像到最新版本
# - 添加 HEALTHCHECK
# - 使用非 root 用户
# - 固定基础镜像 digest

修复后验证

# 修复 Dockerfile 后重新构建
docker build -t myapp:fixed .

# 对比前后
docker scout compare myapp:old myapp:fixed

快速命令组合

# 一键扫描 + 推荐（CI 常用）
docker scout quickview myapp:latest && docker scout recommendations myapp:latest

GitHub Actions 集成 Docker Scout

.github/workflows/scout.yml

name: Docker Scout Security Scan

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 8 * * 1'          # 每周一早 8 点

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      security-events: write     # 写入 Security 标签页

    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v3

      - name: Build image
        uses: docker/build-push-action@v6
        with:
          context: .
          tags: myapp:${{ github.sha }}
          load: true
          cache-from: type=gha
          cache-to: type=gha,mode=max

      - name: Docker Scout scan
        id: scout
        uses: docker/scout-action@v1
        with:
          command: cves,recommendations
          image: myapp:${{ github.sha }}
          sarif-file: scout-results.sarif
          exit-code: true         # 有 Critical/High 漏洞时 CI 失败
          only-severities: critical,high

      - name: Upload SARIF to GitHub
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: scout-results.sarif

策略门禁（CI 阻断）

- name: Docker Scout policy evaluation
  uses: docker/scout-action@v1
  with:
    command: compare
    image: myapp:${{ github.sha }}
    to: myapp:latest             # 和上一次构建比
    exit-on: policy              # 策略恶化时失败
    only-severities: critical,high

效果

• PR 提交后自动扫描，Security 标签页可查看漏洞
• 发现 Critical/High → CI 红叉，阻止合并
• 每周定时扫描，捕获新发现的 CVE

Docker Scout 命令速查

核心命令

quickview

docker scout quickview nginx:1.27-alpine

# 输出：
#    0C     0H     1M     2L  nginx:1.27-alpine
#    ↑      ↑      ↑      ↑
#  Critical High  Medium  Low

cves

# 基本用法
docker scout cves nginx:1.27-alpine

# 仅显示目标严重级别
docker scout cves --only-severity critical,high nginx:1.27-alpine

# 仅显示已修复的
docker scout cves --only-fixed nginx:1.27-alpine

# 忽略基础镜像中的 CVE
docker scout cves --ignore-base nginx:1.27-alpine

# JSON 输出（CI 集成）
docker scout cves --format json nginx:1.27-alpine

recommendations

docker scout recommendations nginx:1.27-alpine

# 输出：
# Recommendation 1 of 3: Use a specific tag
# 使用 :latest 可能引入意外变更，改为 :1.27-alpine

sbom

# 生成 SPDX 格式 SBOM
docker scout sbom --format spdx nginx:1.27-alpine

# 输出 SBOM 到文件
docker scout sbom --output nginx-sbom.spdx.json nginx:1.27-alpine

compare

# 对比两个镜像
docker scout compare nginx:1.26-alpine nginx:1.27-alpine

# 对比同一镜像的两个版本
docker scout compare myapp:v1 myapp:v2 --ignore-base

policy

# 评估策略合规性
docker scout policy myapp:latest

# 输出：
# ✓ Policies passed (12/12)
#   No critical or high CVEs (0/0)
#   No non-official base images
#   Approved licenses only

常用组合

# CI 一键扫描
docker scout quickview myapp:latest && \
  docker scout cves --only-severity critical,high myapp:latest && \
  docker scout recommendations myapp:latest

Docker Scout 策略评估

策略文件结构

# .docker/scout/policy.yaml
apiVersion: docker.com/v1alpha1
kind: Policy
metadata:
  name: production-policy
spec:
  policies:
    - id: no-critical-cves
      description: No critical CVEs allowed
      rules:
        - type: cve
          params:
            severity: critical
            max: 0

    - id: max-high-cves
      description: Maximum 5 high CVEs
      rules:
        - type: cve
          params:
            severity: high
            max: 5

    - id: only-official-images
      description: Base images must be from trusted sources
      rules:
        - type: base-image
          params:
            allowed: [docker.io/library/*, ghcr.io/*, public.ecr.aws/*]

    - id: approved-licenses
      description: Only approved licenses
      rules:
        - type: license
          params:
            allowed: [MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC]
            denied: [GPL-2.0, GPL-3.0, AGPL-3.0]

CI 门禁集成

# 本地验证
docker scout policy --policy .docker/scout/policy.yaml myapp:latest

# GitHub Actions
- uses: docker/scout-action@v1
  with:
    command: policy
    image: myapp:${{ github.sha }}
    policy: .docker/scout/policy.yaml
    exit-on: policy

策略恶化检测

对比基线镜像，仅在新漏洞变多时阻断：

docker scout compare \
  --to myapp:latest \
  --exit-on policy \
  myapp:${{ github.sha }}

严重级别阈值