Skip to content

Commit 686535f

Browse files
authored
Fix: applying code review changes
1 parent 4410112 commit 686535f

File tree

3 files changed

+11
-25
lines changed

3 files changed

+11
-25
lines changed
-8.58 KB
Binary file not shown.
-69.8 KB
Binary file not shown.

content/manuals/scout/quickstart.md

Lines changed: 11 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -84,30 +84,24 @@ Learn more about the `docker scout cves` command in the
8484

8585
## Step 4: Fix application vulnerabilities
8686

87-
The fix suggested by Docker Scout is to update
88-
the underlying vulnerable express version to 4.17.3 or later.
87+
After the Docker Scout analysis, a high vulnerability CVE-2022-24999 was found, caused by an outdated version of the **express** package.
8988

90-
1. Update the `package.json` file with the new package version.
89+
The version 4.17.3 of the express package fizes the vulnerabillity. Therefore, update the `package.json` file to the new version:
9190

9291
```diff
9392
"dependencies": {
9493
- "express": "4.17.1"
9594
+ "express": "4.17.3"
9695
}
9796
```
98-
> [!TIP]
99-
>
100-
> The express package is constantly being updated and depending on when you are running this tutorial, other vulnerabilities with different levels of criticality may be listed. In order to follow this tutorial properly, it is suggested that all vulnerabilities are fixed.
101-
> In general, it will only be necessary to modify the version of the `express` package to the most current version.
102-
103-
2. Rebuild the image with a new tag and push it to your Docker Hub repository:
97+
98+
Rebuild the image with a new tag and push it to your Docker Hub repository:
10499

105100
```console
106101
$ docker build --push -t <ORG_NAME>/scout-demo:v2 .
107102
```
108103

109-
Now, viewing the latest tag of the image in Docker Desktop, the Docker Scout
110-
Dashboard, or CLI, you can see that you have fixed the vulnerability.
104+
Run the **docker scout** command again and verify that HIGH CVE-2022-24999 is no longer present:
111105

112106
```console
113107
$ docker scout cves --only-package express
@@ -158,7 +152,7 @@ $ docker scout config organization <ORG_NAME>
158152

159153
Now you can run the `quickview` command to get an overview
160154
of the compliance status for the image you just built.
161-
The image is evaluated against the default policy configurations.
155+
The image is evaluated against the default policy configurations. You'll see output similar to the following:
162156

163157
```console
164158
$ docker scout quickview
@@ -176,10 +170,6 @@ Policy status FAILED (2/6 policies met, 2 missing data)
176170
? │ Supply chain attestations │ No data
177171
```
178172

179-
> [!NOTE]
180-
>
181-
> The report shown by the `docker scout quickview` command, run on your local machine, may be different from the one shown in the example above.
182-
183173
Exclamation marks in the status column indicate a violated policy.
184174
Question marks indicate that there isn't enough metadata to complete the evaluation.
185175
A check mark indicates compliance.
@@ -217,7 +207,7 @@ The classic image store doesn't support manifest lists,
217207
which is how the provenance attestations are attached to an image.
218208

219209
Open **Settings** in Docker Desktop. Under the **General** section, make sure
220-
that the **Use containerd for pulling and storing images** option is checked, then click the `Apply & Restart` button to apply the changes.
210+
that the **Use containerd for pulling and storing images** option is checked, then select **Apply & Restart**.
221211
Note that changing image stores temporarily hides images and containers of the
222212
inactive image store until you switch back.
223213

@@ -239,9 +229,7 @@ results through a different lens: the Docker Scout Dashboard.
239229

240230
The images page lists your Scout-enabled repositories.
241231

242-
Select the docker image you want to analyze and click the button shown in the image below to display the **Image details** sidebar.
243-
244-
![View Image Details](./images/image-details.png)
232+
Select the row for the image you want to view, anywhere in the row except on a link, to open the **Image details** sidebar.
245233

246234
The sidebar shows a compliance overview for the last pushed tag of a repository.
247235

@@ -251,16 +239,14 @@ The sidebar shows a compliance overview for the last pushed tag of a repository.
251239
> It might take a few minutes before the results appear if this is your
252240
> first time using the Docker Scout Dashboard.
253241
254-
Go back to the image list and click on the image version, available in the **Most recent image** column.
255-
Then, at the top right of the page, click on the **Update base image** button to inspect the policy.
256-
257-
![Policy Inspect](./images/policy-inspect.png)
242+
Go back to the image list and select the image version, available in the **Most recent image** column.
243+
Then, at the top right of the page, select the **Update base image** button to inspect the policy.
258244

259245
This policy checks whether base images you use are up-to-date.
260246
It currently has a non-compliant status,
261247
because the example image uses an old version `alpine` as a base image.
262248

263-
Close the **Recommended fixes for base image** popup. In the policy listing, click the **View fixes** button, next to the policy name for details about the violation, and recommendations on how to address it.
249+
Close the **Recommended fixes for base image** modal. In the policy listing, select **View fixes** button, next to the policy name for details about the violation, and recommendations on how to address it.
264250

265251
In this case, the recommended action is to enable
266252
[Docker Scout's GitHub integration](./integrations/source-code-management/github.md),

0 commit comments

Comments
 (0)