Docker Scout is Docker’s built-in security analysis tool for container images. It scans images for vulnerabilities, generates SBOMs, and suggests fixes. It works inside Docker Desktop, Docker Hub, and the Docker CLI with no extra setup.
Scout builds an inventory of every package and dependency inside a container image (the Software Bill of Materials), then matches those components against a vulnerability database that pulls from 23 advisory sources.
How does Docker Scout scan images?
Docker Scout scans container images by decomposing image layers, identifying OS packages and application dependencies, and matching them against 23 advisory database sources. Results include CVE IDs, severity scores (CVSS v4 when available), affected versions, and remediation steps. The scanning happens automatically when you push an image to Docker Hub, or on-demand through the CLI and Docker Desktop.
Most scanners rely on broad CPE (Common Product Enumeration) matching, which produces false positives when package names overlap. Scout uses Package URLs (PURLs) instead, which ties vulnerabilities to specific packages more precisely. In practice, this means fewer false positives compared to CPE-based scanners.
What are Docker Scout’s key features?
| Feature | Details |
|---|---|
| Advisory sources | 23 databases including NVD, GitHub, GitLab, CISA KEV, EPSS, and distribution trackers |
| SBOM formats | CycloneDX, SPDX |
| Severity scoring | CVSS v4 preferred, falls back to v3, vendor scores prioritized over NIST |
| Matching method | Package URL (PURL) matching instead of broad CPE matching |
| VEX support | Vulnerability Exploitability eXchange for suppressing non-applicable findings |
| Integration points | Docker Desktop, Docker Hub, Docker CLI, CI/CD platforms, third-party registries |
| Free tier | 1 repo with continuous analysis (Docker Personal) |
Docker Desktop integration
Scout is built into Docker Desktop. Pull or build an image, and vulnerability information shows up in the Desktop UI without any extra setup. CVEs, affected packages, and remediation suggestions are right there in the same interface you use for container management.
Policy evaluation
The policy evaluation engine lets security teams set standards that images must meet before deployment. You can check for severity thresholds, required base image versions, outdated packages, and compliance with organizational baselines. Policy results plug into CI/CD pipelines to gate deployments.
VEX support
Scout supports VEX (Vulnerability Exploitability eXchange) statements. When a CVE exists in a package but is not exploitable in your specific context, you attach a VEX statement to suppress it from results. This keeps the noise down so your team focuses on vulnerabilities that actually matter.
CLI scanning
The docker scout CLI commands work with any locally available image:
# Quick vulnerability overview
docker scout quickview myapp:latest
# Detailed CVE listing
docker scout cves myapp:latest
# Compare two image versions
docker scout compare myapp:latest --to myapp:previous
# Generate SBOM
docker scout sbom myapp:latest --format spdx-json > sbom.json
Who should use Docker Scout?
Docker Scout is best suited for teams already working within the Docker ecosystem. If your workflow runs through Docker Desktop, Docker Hub, and Docker CLI, Scout adds vulnerability scanning without bringing in another tool or vendor. It requires zero additional installation or configuration for Docker Desktop users.
The free tier (Docker Personal) provides continuous vulnerability analysis for 1 repository, making it accessible for individual developers. Docker Pro includes 2 Scout-enabled repos. Larger organizations on Docker Team or Business plans get unlimited Scout-enabled repositories for continuous monitoring across all their images.
What are Docker Scout’s limitations?
Scout only does container image analysis. It does not scan IaC files, Kubernetes clusters, source code, or running workloads. If you need broader coverage, pair it with Trivy (IaC and Kubernetes), Falco (runtime), or Kubescape (Kubernetes posture).
Scout is cloud-backed, meaning image analysis data goes through Docker’s infrastructure. If you have strict data residency requirements, check whether that works for your compliance posture.
Scanning depth depends on Docker’s advisory database. The 23 sources provide solid coverage, but matching is only as good as the SBOM extraction from image layers. Heavily customized or distroless images may have gaps in package identification.
For other container security options, browse our container security tools category.
