You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: content/manuals/scout/quickstart.md
+11-25Lines changed: 11 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -84,30 +84,24 @@ Learn more about the `docker scout cves` command in the
84
84
85
85
## Step 4: Fix application vulnerabilities
86
86
87
-
The fix suggested by Docker Scout is to update
88
-
the underlying vulnerable express version to 4.17.3 or later.
87
+
After the Docker Scout analysis, a high vulnerability CVE-2022-24999 was found, caused by an outdated version of the **express** package.
89
88
90
-
1. Update the `package.json` file with the new package version.
89
+
The version 4.17.3 of the express package fizes the vulnerabillity. Therefore, update the `package.json` file to the new version:
91
90
92
91
```diff
93
92
"dependencies": {
94
93
- "express": "4.17.1"
95
94
+ "express": "4.17.3"
96
95
}
97
96
```
98
-
> [!TIP]
99
-
>
100
-
> The express package is constantly being updated and depending on when you are running this tutorial, other vulnerabilities with different levels of criticality may be listed. In order to follow this tutorial properly, it is suggested that all vulnerabilities are fixed.
101
-
> In general, it will only be necessary to modify the version of the `express` package to the most current version.
102
-
103
-
2. Rebuild the image with a new tag and push it to your Docker Hub repository:
97
+
98
+
Rebuild the image with a new tag and push it to your Docker Hub repository:
> The report shown by the `docker scout quickview` command, run on your local machine, may be different from the one shown in the example above.
182
-
183
173
Exclamation marks in the status column indicate a violated policy.
184
174
Question marks indicate that there isn't enough metadata to complete the evaluation.
185
175
A check mark indicates compliance.
@@ -217,7 +207,7 @@ The classic image store doesn't support manifest lists,
217
207
which is how the provenance attestations are attached to an image.
218
208
219
209
Open **Settings** in Docker Desktop. Under the **General** section, make sure
220
-
that the **Use containerd for pulling and storing images** option is checked, then click the `Apply & Restart` button to apply the changes.
210
+
that the **Use containerd for pulling and storing images** option is checked, then select **Apply & Restart**.
221
211
Note that changing image stores temporarily hides images and containers of the
222
212
inactive image store until you switch back.
223
213
@@ -239,9 +229,7 @@ results through a different lens: the Docker Scout Dashboard.
239
229
240
230
The images page lists your Scout-enabled repositories.
241
231
242
-
Select the docker image you want to analyze and click the button shown in the image below to display the **Image details** sidebar.
243
-
244
-

232
+
Select the row for the image you want to view, anywhere in the row except on a link, to open the **Image details** sidebar.
245
233
246
234
The sidebar shows a compliance overview for the last pushed tag of a repository.
247
235
@@ -251,16 +239,14 @@ The sidebar shows a compliance overview for the last pushed tag of a repository.
251
239
> It might take a few minutes before the results appear if this is your
252
240
> first time using the Docker Scout Dashboard.
253
241
254
-
Go back to the image list and click on the image version, available in the **Most recent image** column.
255
-
Then, at the top right of the page, click on the **Update base image** button to inspect the policy.
256
-
257
-

242
+
Go back to the image list and select the image version, available in the **Most recent image** column.
243
+
Then, at the top right of the page, select the **Update base image** button to inspect the policy.
258
244
259
245
This policy checks whether base images you use are up-to-date.
260
246
It currently has a non-compliant status,
261
247
because the example image uses an old version `alpine` as a base image.
262
248
263
-
Close the **Recommended fixes for base image**popup. In the policy listing, click the**View fixes** button, next to the policy name for details about the violation, and recommendations on how to address it.
249
+
Close the **Recommended fixes for base image**modal. In the policy listing, select**View fixes** button, next to the policy name for details about the violation, and recommendations on how to address it.
0 commit comments