Docker Scout — 镜像漏洞扫描与 SBOM
Guidance for vulnerability scanning, SBOM generation, and policy enforcement.
When to Use
ALWAYS use this skill when the user mentions:
- "docker scout", "镜像扫描", "漏洞扫描"
- "CVE", "vulnerability", "SBOM"
- "软件物料清单"
- "镜像安全分析", "image security scan"
- "policy evaluation"
Core Commands
# Quick vulnerability overview
docker scout quickview myimage:tag
# Detailed CVE report
docker scout cves --format table myimage:tag
docker scout cves --only-fixed myimage:tag # Show only fixable CVEs
docker scout cves --severity critical,high myimage:tag
# SBOM (Software Bill of Materials)
docker scout sbom myimage:tag # SPDX format
docker scout sbom --format cyclonedx myimage:tag # CycloneDX format
# Compare two images
docker scout compare myimage:v1 --to myimage:v2
# Policy evaluation
docker scout policy myimage:tag
CVE Severity Levels
| Level | Action |
|-------|--------|
| Critical | Fix immediately |
| High | Fix in current sprint |
| Medium | Schedule fix |
| Low | Monitor |
| Unspecified | Review |
CI/CD Integration
GitHub Actions
- name: Docker Scout
uses: docker/scout-action@v1
with:
command: cves,compare
image: ${{ steps.meta.outputs.tags }}
compare-to: registry/${{ env.IMAGE_NAME }}:latest
Remediation Workflow
1. docker scout cves myimage:tag → Identify CVEs
2. Check if fixable: --only-fixed shows which have patches
3. Update base image: FROM alpine:3.20 (newer version)
4. Update dependencies: npm update / pip install --upgrade / apt upgrade
5. Rebuild: docker build -t myimage:v2 .
6. Verify: docker scout compare myimage:v1 --to myimage:v2
Workflow — 推荐扫描流程
Step 1: 快速扫描: docker scout quickview <image> 获得 CVE 摘要
Step 2: 详细分析: docker scout cves --only-severity critical,high <image>
Step 3: 查看建议: docker scout recommendations <image> 获取修复方案
Step 4: 修复重建: 更新基础镜像/依赖 → docker build → 再次扫描验证
Step 5: CI 集成: docker/scout-action + 策略门禁阻断
Gotchas — Common Pitfalls
- Scout vs scan:
docker scan (Snyk-based, deprecated). → Recovery: Always use docker scout instead; uninstall old docker scan plugin.
- Only scanning, not fixing: Scout shows CVEs but doesn't fix them. → Recovery:
docker scout recommendations <image> for fix suggestions; update base image or rebuild with newer dependencies.
- Base image CVEs: Many CVEs come from the base image. → Recovery:
docker pull alpine:3.20 (update base); pin digest to avoid accidental downgrades; monitor with docker scout cves alpine:3.20.
- Multi-stage skip: Scanner needs access to both stages. → Recovery: Ensure all stage artifacts are
COPY --from=... properly; tag intermediate stages if needed.
Boundary — 能力边界（适用与不适用场景）
| 分类 | 场景 | 说明 |
|------|------|------|
| ✅ 能做 | CVE 漏洞扫描 | CLI: docker scout cves + quickview |
| ✅ 能做 | SBOM 生成 | docker scout sbom --format spdx |
| ✅ 能做 | 策略评估与 CI 阻断 | policy evaluation + GitHub Actions |
| ⚠️ 需条件 | 私有仓库扫描 | 需 Docker Scout 订阅 |
| ⚠️ 需条件 | 跨组织比较 | 需 Scout Dashboard（Web UI） |
| ❌ 超范围 | 运行时安全 | 使用 docker-security |
| ❌ 超范围 | 第三方扫描器（Trivy/Grype） | 各工具独立使用 |
| ❌ 超范围 | 修复漏洞（更新依赖） | 开发者自行完成 |
When NOT to Use This Skill
| ❌ Skip | ✅ Use Instead |
|---------|---------------|
| Runtime security (seccomp/AppArmor) | docker-security |
| Building images | docker-build |
| CI/CD pipeline setup | docker-cicd |
| Registry management | docker-hub |
Security & Stability
- Run Scout in CI/CD to catch vulnerabilities before deployment.
- Subscribe to Docker security advisories for zero-day notifications.
- No executable scripts bundled. Guidance only.
📚 官方文档参考
| 文档 | 地址 |
|------|------|
| Docker Scout 概述 | https://docs.docker.com/scout/ |
| Scout 快速入门 | https://docs.docker.com/scout/quickstart/ |
| Scout CLI 参考 | https://docs.docker.com/reference/cli/docker/scout/ |
| 策略评估 | https://docs.docker.com/scout/policy/ |
| CI 集成 | https://docs.docker.com/scout/integrations/ci/ |
| SBOM 管理 | https://docs.docker.com/scout/explore/sbom/ |
🧭 Docker Skills Journey
📍 You are here: docker-scout — 镜像安全扫描
← Prev: docker-security — Security hardening
→ Next: docker-hub — Registry management
FAQ
Q1: 如何快速上手此技能？
A: 参考上方的快速开始章节，按步骤操作即可。
Q2: 遇到版本不兼容问题怎么办？
A: 检查依赖版本，使用 lock 文件锁定，参考常见陷阱章节。
Q3: 如何在生产环境使用？
A: 参考最佳实践章节，确保配置正确，做好监控和日志。
Q4: 性能如何优化？
A: 参考性能优化相关文档，使用缓存、索引等手段。
Q5: 如何贡献或反馈问题？
A: 在 GitHub 仓库提交 Issue 或 Pull Request。
Q6: 是否支持中文？
A: 支持中文文档和中文注释，详见国内适配章节。