diff --git a/_vale/config/vocabularies/Docker/accept.txt b/_vale/config/vocabularies/Docker/accept.txt index 48cfd4c6fdd2..75ac4e3e93b7 100644 --- a/_vale/config/vocabularies/Docker/accept.txt +++ b/_vale/config/vocabularies/Docker/accept.txt @@ -225,6 +225,7 @@ Sigstore Snyk Solr SonarQube +Sonatype Sonoma Splunk SQLite diff --git a/content/guides/docker-scout.md b/content/guides/docker-scout.md index 04fc6a06dba2..eb5806e33359 100644 --- a/content/guides/docker-scout.md +++ b/content/guides/docker-scout.md @@ -247,11 +247,11 @@ control over your image's security. {{< youtube-embed jM9zLBf8M-8 >}} -Docker Scout's [remediation feature](/manuals/scout/policy/dashboard.md) -helps you address supply chain and security issues by offering tailored -recommendations based on policy evaluations. These recommendations guide you in -improving policy compliance or enhancing image metadata, allowing Docker Scout -to perform more accurate evaluations in the future. +Docker Scout's remediation feature helps you address supply chain and +security issues by offering tailored recommendations based on policy +evaluations. These recommendations guide you in improving policy compliance +or enhancing image metadata, allowing Docker Scout to perform more accurate +evaluations in the future. You can use this feature to ensure that your base images are up-to-date and that your supply chain attestations are complete. When a violation occurs, @@ -259,10 +259,10 @@ Docker Scout provides recommended fixes, such as updating your base image or adding missing attestations. If there isn’t enough information to determine compliance, Docker Scout suggests actions to help resolve the issue. -In the Docker Scout Dashboard, you can view and act on these recommendations by -reviewing violations or compliance uncertainties. With integrations like -GitHub, you can even automate updates, directly fixing issues from the -dashboard. +You can view and act on these recommendations in Docker Desktop or Docker Hub, +see [Remediation recommendations](/manuals/scout/explore/image-details-view.md#remediation-recommendations), +or from the CLI with +[`docker scout recommendations`](/reference/cli/docker/scout/recommendations/).
diff --git a/content/manuals/build/building/best-practices.md b/content/manuals/build/building/best-practices.md index f9485bb7f337..b8fd16d36a5d 100644 --- a/content/manuals/build/building/best-practices.md +++ b/content/manuals/build/building/best-practices.md @@ -259,15 +259,15 @@ checks if pinned digests in your Dockerfile correspond to the correct version. If a publisher updates an image that you've pinned, the policy evaluation returns a non-compliant status, indicating that you should update your image. -Docker Scout also supports an automated remediation workflow for keeping your -base images up-to-date. When a new image digest is available, Docker Scout can -automatically raise a pull request on your repository to update your -Dockerfiles to use the latest version. This is better than using a tag that -changes the version automatically, because you're in control and you have an -audit trail of when and how the change occurred. - -For more information about automatically updating your base images with Docker -Scout, see [Remediation](/manuals/scout/policy/dashboard.md). +To keep your base images up-to-date automatically, use +[GitHub Dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates) +with `package-ecosystem: "docker"`. Dependabot raises pull requests to update +your base image tags and digests on a schedule. This is better than using a tag +that changes the version automatically, because you're in control and you have +an audit trail of when and how the change occurred. + +You can also review available base image updates from the CLI with +[`docker scout recommendations`](/reference/cli/docker/scout/recommendations/). ## Build and test your images in CI diff --git a/content/manuals/retired.md b/content/manuals/retired.md index 2b5401bfd6b7..e08227aaa2eb 100644 --- a/content/manuals/retired.md +++ b/content/manuals/retired.md @@ -65,6 +65,9 @@ aliases: - /desktop/features/dev-environments/ - /scout/policy/scores/ - /scout/integrations/environment/sysdig/ + - /scout/integrations/team-collaboration/slack/ + - /scout/integrations/code-quality/sonarqube/ + - /scout/integrations/source-code-management/github/ --- This document provides an overview of Docker features, products, and @@ -160,23 +163,31 @@ details, see the [Scout platform release notes](/manuals/scout/release-notes/pla Retired July 1, 2026. - GitHub source code management integration: linked images to their source repository and automated base-image updates via PRs. Retired July 1, 2026. - For migration options, see - [GitHub integration](/manuals/scout/integrations/source-code-management/github.md). -- Notifications: alerted users to newly disclosed CVEs in-product and by email. - Deprecated, retiring September 1, 2026. + For base-image updates, use + [GitHub Dependabot](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates) + with `package-ecosystem: "docker"`. For image-to-source linkage, build with + `--provenance=mode=max`. This retirement doesn't affect the + [`docker/scout-action`](https://github.com/docker/scout-action) GitHub Action + for CI pipelines. - Slack integration: sent vulnerability and policy compliance notifications to - Slack channels. Deprecated, retiring July 30, 2026. For more information, - see [Slack integration](/manuals/scout/integrations/team-collaboration/slack.md). -- Amazon ECR integration: automatically analyzed images pushed to ECR - registries. Deprecated, retiring September 1, 2026. For migration options, see - [ECR integration](/manuals/scout/integrations/registry/ecr.md). -- Azure Container Registry integration: automatically analyzed images pushed to - ACR registries. Deprecated, retiring September 1, 2026. For migration options, - see [ACR integration](/manuals/scout/integrations/registry/acr.md). + Slack channels. Retired July 30, 2026. +- Notifications: alerted users to newly disclosed CVEs in-product and by + email. Retired September 1, 2026. To surface CVE and policy results without + push notifications, integrate `docker scout cves` or `docker scout policy` + into your CI pipeline. +- Native Amazon ECR integration: automatically analyzed images pushed to ECR + registries using a CloudFormation stack. Retired September 1, 2026. Docker + Scout still supports ECR through + [`docker scout watch`](/manuals/scout/integrations/registry/_index.md). +- Native Azure Container Registry integration: automatically analyzed images + pushed to ACR registries using an ARM template. Retired September 1, 2026. + Docker Scout still supports ACR through + [`docker scout watch`](/manuals/scout/integrations/registry/_index.md). - Policies page in the Dashboard: the `docker scout policy` - CLI continues to work. Deprecated, retiring September 1, 2026. See + CLI continues to work. Retired September 1, 2026. See [Evaluate policies](/manuals/scout/policy/local.md). -- SonarQube integration: surfaced SonarQube quality gate results as a Docker Scout policy. Deprecated, retiring September 1, 2026. +- SonarQube integration: surfaced SonarQube quality gate results as a Docker + Scout policy. Retired September 1, 2026. ### GitHub Copilot extension diff --git a/content/manuals/scout/explore/dashboard.md b/content/manuals/scout/explore/dashboard.md index 6608452eeee0..c41b2709fd5f 100644 --- a/content/manuals/scout/explore/dashboard.md +++ b/content/manuals/scout/explore/dashboard.md @@ -84,46 +84,11 @@ affected by the CVE. The settings menu in the Docker Scout Dashboard contains: - [**Repository settings**](#repository-settings) for enabling and disabling repositories. -- [**Notifications**](#notification-settings) for managing your notification preferences. ### Repository settings When you enable Docker Scout for a repository, Docker Scout analyzes new tags automatically when you push to that repository. -To enable repositories in Amazon ECR, Azure ACR, or other third-party registries, -you first need to integrate them. -See [Container registry integrations](/manuals/scout/integrations/_index.md#container-registries) - -### Notification settings - -> [!IMPORTANT] -> -> Docker Scout notifications are deprecated and will be retired on -> July 30, 2026. To surface CVE and policy results without push notifications, -> integrate `docker scout cves` or `docker scout policy` into your CI pipeline. -> See [CI integrations](/manuals/scout/integrations/_index.md#continuous-integration). -> For details, see the -> [Scout platform release notes](/manuals/scout/release-notes/platform.md). - -The [Notification settings](https://scout.docker.com/settings/notifications) -page is where you can change the preferences for receiving notifications from -Docker Scout. Notification settings are personal, and changing notification -settings only affects your personal account, not the entire organization. - -Docker Scout notifies you when a new vulnerability is disclosed in a security -advisory and it affects one or more of your images. Notifications are only -triggered for the _last pushed_ image tags for each repository. - -The available notification settings are: - -- **Repository scope**: select whether you want notifications for all - repositories or only specific ones. -- **Delivery preferences**: choose between in-product notification pop-ups - and OS-level browser notifications. - -You can also configure your notification settings in Docker Desktop by going -to **Settings** > **Notifications**. - -From this page, you can also go to the settings for -[Team collaboration integrations](/manuals/scout/integrations/team-collaboration/slack.md). +To enable repositories in third-party registries, you first need to integrate +them. See [Container registry integrations](/manuals/scout/integrations/_index.md#container-registries) diff --git a/content/manuals/scout/images/Scout-ECR.png b/content/manuals/scout/images/Scout-ECR.png deleted file mode 100644 index 70b1fb178107..000000000000 Binary files a/content/manuals/scout/images/Scout-ECR.png and /dev/null differ diff --git a/content/manuals/scout/images/scout-slack-notification.png b/content/manuals/scout/images/scout-slack-notification.png deleted file mode 100644 index 14c2207b0d4d..000000000000 Binary files a/content/manuals/scout/images/scout-slack-notification.png and /dev/null differ diff --git a/content/manuals/scout/integrations/_index.md b/content/manuals/scout/integrations/_index.md index a37b83a68d29..c884a345809a 100644 --- a/content/manuals/scout/integrations/_index.md +++ b/content/manuals/scout/integrations/_index.md @@ -23,11 +23,9 @@ registries enables Docker Scout to run image analysis on those repositories, so that you can get insights into the composition of those images even if they aren't hosted on Docker Hub. -The following container registry integrations are available: - -- [Amazon Elastic Container Registry](./registry/ecr.md) (deprecated, retiring September 1, 2026) -- [Azure Container Registry](./registry/acr.md) (deprecated, retiring September 1, 2026) -- [JFrog Artifactory](./registry/artifactory.md) +Docker Scout integrates with any Docker/OCI-compliant registry using +[`docker scout watch`](./registry/_index.md), including Amazon ECR, Azure +Container Registry, JFrog Artifactory, Harbor, and Sonatype Nexus. ### Continuous Integration @@ -58,39 +56,3 @@ The following environment monitoring integrations are available: For more information about environment integrations, see [Environments](./environment/_index.md). - -### Code quality - -Integrating Docker Scout with code analysis tools enables quality checks -directly on source code, helping you keep track of bugs, security issues, test -coverage, and more. In addition to image analysis and environment monitoring, -code quality gates let you shift left your supply chain management with Docker -Scout. - -Once you enable a code quality integration, Docker Scout includes the code -quality assessments as policy evaluation results for the repositories where -you've enabled the integration. - -The following code quality integrations are available: - -- [SonarQube](./code-quality/sonarqube.md) (deprecated, retiring September 1, 2026) - -### Source code management - -Integrate Docker Scout with your version control system to get guided -remediation advice on how to address issues detected by Docker Scout image -analysis, directly in your repositories. - -The following source code management integrations are available: - -- [GitHub](source-code-management/github.md) (retired) - -### Team collaboration - -Integrations in this category let you integrate Docker Scout with collaboration -platforms for broadcasting notifications about your software supply chain in -real-time to team communication platforms. - -The following team collaboration integrations are available: - -- [Slack](./team-collaboration/slack.md) (deprecated, retiring September 1, 2026) diff --git a/content/manuals/scout/integrations/code-quality/_index.md b/content/manuals/scout/integrations/code-quality/_index.md deleted file mode 100644 index 16f010710765..000000000000 --- a/content/manuals/scout/integrations/code-quality/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -build: - render: never -title: Code quality ---- diff --git a/content/manuals/scout/integrations/code-quality/sonarqube.md b/content/manuals/scout/integrations/code-quality/sonarqube.md deleted file mode 100644 index 0d2bb019732a..000000000000 --- a/content/manuals/scout/integrations/code-quality/sonarqube.md +++ /dev/null @@ -1,86 +0,0 @@ ---- -title: Integrate Docker Scout with SonarQube -linkTitle: SonarQube -description: Evaluate your images with the SonarQube quality gates defined in your projects -keywords: scout, supply chain, integration, code quality -params: - sidebar: - badge: - color: gray - text: Deprecated ---- - -> [!IMPORTANT] -> -> The Docker Scout SonarQube integration is deprecated and will be retired on -> September 1, 2026. Migration guidance will be provided. For details, see the -> [Scout platform release notes](/manuals/scout/release-notes/platform.md). - -The SonarQube integration enables Docker Scout to surface SonarQube quality -gate checks through Policy Evaluation, under a new [SonarQube Quality Gates -Policy](/manuals/scout/policy/_index.md#sonarqube-quality-gates-policy). - -## How it works - -This integration uses [SonarQube -webhooks](https://docs.sonarsource.com/sonarqube/latest/project-administration/webhooks/) -to notify Docker Scout of when a SonarQube project analysis has completed. When -the webhook is called, Docker Scout receives the analysis results, and stores -them in the database. - -When you push a new image to a repository, Docker Scout evaluates the results -of the SonarQube analysis record corresponding to the image. Docker Scout uses -Git provenance metadata on the images, from provenance attestations or an OCI -annotations, to link image repositories with SonarQube analysis results. - -> [!NOTE] -> -> Docker Scout doesn't have access to historic SonarQube analysis records. Only -> analysis results recorded after the integration is enabled will be available -> to Docker Scout. - -Both self-managed SonarQube instances and SonarCloud are supported. - -## Prerequisites - -To integrate Docker Scout with SonarQube, ensure that: - -- Your image repository is [integrated with Docker Scout](../_index.md#container-registries). -- Your images are built with [provenance attestations](/manuals/build/metadata/attestations/slsa-provenance.md), - or the `org.opencontainers.image.revision` annotation, - containing information about the Git repository. - -## Enable the SonarQube integration - -1. Go to the [SonarQube integrations page](https://scout.docker.com/settings/integrations/sonarqube/) - on the Docker Scout Dashboard. -2. In the **How to integrate** section, enter a configuration name for this - integration. Docker Scout uses this label as a display name for the - integration, and to name the webhook. -3. Select **Next**. -4. Enter the configuration details for your SonarQube instance. Docker Scout - uses this information to create SonarQube webhook. - - In SonarQube, [generate a new **User token**](https://docs.sonarsource.com/sonarqube/latest/user-guide/user-account/generating-and-using-tokens/#generating-a-token). - The token requires 'Administer' permission on the specified project, or - global 'Administer' permission. - - Enter the token, your SonarQube URL, and the ID of your SonarQube - organization. The SonarQube organization is required if you're using - SonarCloud. - -5. Select **Enable configuration**. - - Docker Scout performs a connection test to verify that the provided details - are correct, and that the token has the necessary permissions. - -6. After a successful connection test, you're redirected to the SonarQube - integration overview, which lists all your SonarQube integrations and their - statuses. - -From the integration overview page, you can go directly to the -**SonarQube Quality Gates Policy**. -This policy will have no results initially. To start seeing evaluation results -for this policy, trigger a new SonarQube analysis of your project and push the -corresponding image to a repository. For more information, refer to the -[policy description](../../policy/_index.md#sonarqube-quality-gates). diff --git a/content/manuals/scout/integrations/registry/_index.md b/content/manuals/scout/integrations/registry/_index.md index 87f014cb712b..7c09f767e9cd 100644 --- a/content/manuals/scout/integrations/registry/_index.md +++ b/content/manuals/scout/integrations/registry/_index.md @@ -1,5 +1,191 @@ --- -build: - render: never -title: Container registries +title: Integrate Docker Scout with a container registry +linkTitle: Container registries +description: Integrate Docker Scout with any container registry using the docker scout watch CLI command +keywords: docker scout, registry, integration, image analysis, security, cves, watch, ecr, acr, artifactory, harbor, nexus +aliases: + - /scout/integrations/registry/artifactory/ + - /scout/artifactory/ + - /scout/integrations/registry/ecr/ + - /scout/integrations/registry/acr/ --- + +[`docker scout watch`](/reference/cli/docker/scout/watch/) is a long-running +CLI process that indexes images from a container registry and pushes the +results to Docker Scout. It works with any Docker/OCI-compliant registry, +including Amazon ECR, Azure Container Registry, JFrog Artifactory, Harbor, and +Sonatype Nexus. + +## How it works + +You run `docker scout watch` on a host you control. The process can: + +- Watch specific repositories or an entire registry +- Optionally ingest all existing images once, using `--all-images` +- Periodically refresh repository lists, using `--refresh-registry` +- Receive webhook callbacks from registries that support them, for + near-real-time analysis instead of polling + +After the integration, Docker Scout automatically pulls and analyzes images +that you push to the registry. Metadata about your images are stored on the +Docker Scout platform, but Docker Scout doesn't store the container images +themselves. For more information about how Docker Scout handles image data, +see [Data handling](/manuals/scout/deep-dive/data-handling.md). + +## Set up `docker scout watch` + +1. Pick a host on which to run `docker scout watch`. + + The host must have network access to your registry and be able to access + the Scout API (`https://api.scout.docker.com`) over the internet. If + you're using webhook callbacks, the registry must also be able to reach the + `docker scout watch` host on the configured port. + +2. Ensure you are running the latest version of Scout. + + ```console + $ docker scout version + ``` + + If necessary, [install the latest version of Scout](/manuals/scout/install.md). + +3. Authenticate Docker to your registry. + + ```console + $ docker login --username --password + ``` + + For Amazon ECR, authenticate using the AWS CLI instead: + + ```console + $ aws ecr get-login-password --region | \ + docker login --username AWS --password-stdin \ + .dkr.ecr..amazonaws.com + ``` + + The AWS identity used must have at least `ecr:GetAuthorizationToken` and + `ecr:BatchGetImage` permissions on the target registry. + + For Azure Container Registry: + + ```console + $ docker login .azurecr.io \ + --username \ + --password + ``` + + > [!TIP] + > + > As a best practice, use a dedicated user or token with read-only access + > to the registry. + +4. Set up your Scout credentials. + + 1. Generate an organization access token. For more details, see + [Create an organization access token](/enterprise/security/access-tokens/#create-an-organization-access-token). + 2. Sign in to Docker using the organization access token. + + ```console + $ docker login --username + ``` + + When prompted for a password, paste the organization access token. + + 3. Connect your local Docker environment to your organization's Docker Scout service. + + ```console + $ docker scout enroll + ``` + +5. Index existing images. You only need to do this once. + + ```console + $ docker scout watch --registry --all-images + ``` + +6. Confirm the images have been indexed by viewing them on the + [Scout Dashboard](https://scout.docker.com/). + +7. Continuously watch for new images. + + ```console + $ docker scout watch --registry --refresh-registry + ``` + + `docker scout watch` is a long-running process. Run it as a system + service, for example using `systemd` or `nohup`, to ensure it continues + running in the background. Use `--interval` (default 60 seconds) to + control polling frequency, and `--repository` and `--tag` to narrow scope. + +Reference: [`docker scout watch`](/reference/cli/docker/scout/watch/) + +## Registry-specific options + +Some registries need extra configuration beyond a hostname, passed through +the `--registry` flag as a `key=value` string, for example a REST API +endpoint for webhook callbacks, or a non-standard repository layout. Built-in +adapters exist for `type=artifactory`, `type=harbor`, and `type=nexus`, and a +`type=oci` adapter covers any OCI-compliant registry that implements the +`_catalog` endpoint. For the full option reference for each type, see +[`docker scout watch`](/reference/cli/docker/scout/watch/). + +The following example walks through the `type=artifactory` adapter in detail. +See the CLI reference for equivalent Harbor, Nexus, and generic OCI examples. + +### Example: JFrog Artifactory + +These `type=artifactory` options override the generic registry handling for +the `--registry` option: + +| Key | Required | Description | +|------------------|:--------:|----------------------------------------------------------------------------------------| +| `type` | Yes | Must be `artifactory`. | +| `registry` | Yes | Docker/OCI registry hostname (e.g., `example.jfrog.io`). | +| `api` | Yes | Artifactory REST API base URL (e.g., `https://example.jfrog.io/artifactory`). | +| `repository` | Yes | Repository to watch (replaces `--repository`). | +| `includes` | No | Globs to include (e.g., `*/frontend*`). | +| `excludes` | No | Globs to exclude (e.g., `*/legacy/*`). | +| `port` | No | Local port to listen on for webhook callbacks. | +| `subdomain-mode` | No | `true` or `false`; matches Artifactory's Docker layout (subdomain versus repository-path). | + +Set up credentials for the Scout client to authenticate with Artifactory, and +a secret for Artifactory to authenticate its webhook callbacks: + +```console +$ export DOCKER_SCOUT_ARTIFACTORY_API_USER= +$ export DOCKER_SCOUT_ARTIFACTORY_API_PASSWORD= +$ export DOCKER_SCOUT_ARTIFACTORY_WEBHOOK_SECRET= +``` + +> [!TIP] +> +> As a best practice, create a dedicated user with read-only access and use an +> access token instead of a password. Generate the webhook secret as a +> high-entropy random string of 64-128 characters. + +Index existing images with the Artifactory-specific registry string: + +```console +$ docker scout watch --registry \ + "type=artifactory,registry=example.jfrog.io,api=https://example.jfrog.io/artifactory,include=*/frontend*,exclude=*/dta/*,repository=docker-local,port=9000,subdomain-mode=true" \ + --all-images +``` + +Then configure Artifactory to call the webhook: in your Artifactory UI or via +REST API, set up a webhook for image push/update events, pointing to your +`docker scout watch` host and port, and include the +`DOCKER_SCOUT_ARTIFACTORY_WEBHOOK_SECRET` for authentication. For more +information, see the [JFrog Artifactory Webhooks +documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/webhooks) +or the [JFrog Artifactory REST API Webhooks +documentation](https://jfrog.com/help/r/jfrog-rest-apis/webhooks). + +Finally, run the same command with `--refresh-registry` instead of +`--all-images` as your long-running watch process, so new images are picked up +going forward: + +```console +$ docker scout watch --registry \ + "type=artifactory,registry=example.jfrog.io,api=https://example.jfrog.io/artifactory,include=*/frontend*,exclude=*/dta/*,repository=docker-local,port=9000,subdomain-mode=true" \ + --refresh-registry +``` diff --git a/content/manuals/scout/integrations/registry/acr.md b/content/manuals/scout/integrations/registry/acr.md deleted file mode 100644 index c0dc9b4d813c..000000000000 --- a/content/manuals/scout/integrations/registry/acr.md +++ /dev/null @@ -1,252 +0,0 @@ ---- -description: Integrate Azure Container Registry with Docker Scout -keywords: docker scout, acr, azure, integration, image analysis, security, cves -title: Integrate Docker Scout with Azure Container Registry -linkTitle: Azure Container Registry -params: - sidebar: - badge: - color: gray - text: Deprecated ---- - -> [!IMPORTANT] -> -> The Docker Scout Azure Container Registry integration is deprecated and will be retired on September 1, 2026. -> Migrate to [`docker scout watch`](/reference/cli/docker/scout/watch/) for -> continuous analysis, or integrate Scout into your CI pipeline. -> See [Migrate from the ACR integration](#migrate-from-the-acr-integration). - -Integrating Docker Scout with Azure Container Registry (ACR) lets you view -image insights for images hosted in ACR repositories. After integrating Docker -Scout with ACR and activating Docker Scout for a repository, pushing an image -to the repository automatically triggers image analysis. You can view image -insights using the Docker Scout Dashboard, or the `docker scout` CLI commands. - -## How it works - -To help you integrate your Azure Container Registry with Docker Scout, you can -use a custom Azure Resource Manager (ARM) template that automatically creates -the necessary infrastructure in Azure for you: - -- An EventGrid Topic and Subscription for Image push and delete events. -- A read-only authorization token for the registry, used to list repositories, - and ingest the images. - -When the resources have been created in Azure, you can enable the integration -for image repositories in the integrated ACR instance. Once you've enabled a -repository, pushing new images triggers image analysis automatically. The -analysis results appear in the Docker Scout Dashboard. - -If you enable the integration on a repository that already contains images, -Docker Scout pulls and analyzes the latest image version automatically. - -### ARM template - -The following table describes the configuration resources. - -> [!NOTE] -> -> Creating these resources incurs a small, recurring cost on the Azure account. -> The **Cost** column in the table represents an estimated monthly cost of the -> resources, when integrating an ACR registry that gets 100 images pushed per -> day. -> -> The Egress cost varies depending on usage, but it’s around $0.1 per GB, and -> the first 100 GB are free. - -| Azure | Resource | Cost | -| ----------------------- | ------------------------------------------------------------------------------------------ | ------------------------------------------------- | -| Event Grid system topic | Subscribe to Azure Container Registry events (image push and image delete) | Free | -| Event subscription | Send Event Grid events to Scout via a Webhook subscription | $0.60 for every 1M messages. First 100k for free. | -| Registry Token | Read-only token used for Scout to list the repositories, and pull images from the registry | Free | - -The following JSON document shows the ARM template Docker Scout uses to create -the Azure resources. - -{{< accordion title="JSON template" >}} - -{{< acr-template.inline >}} -{{ with resources.GetRemote "https://prod-scout-integration-templates.s3.amazonaws.com/latest/acr_token_template.json" }} -{{ $data := .Content | transform.Unmarshal }} - -```json -{{ transform.Remarshal "json" $data }} -``` - -{{ end }} -{{< /acr-template.inline >}} - -{{< /accordion >}} - -## Integrate a registry - -1. Go to [ACR integration page](https://scout.docker.com/settings/integrations/azure/) on the - Docker Scout Dashboard. -2. In the **How to integrate** section, enter the **Registry hostname** of the - registry you want to integrate. -3. Select **Next**. -4. Select **Deploy to Azure** to open the template deployment wizard in Azure. - - You may be prompted to sign in to your Azure account if you're not already - signed in. - -5. In the template wizard, configure your deployment: - - - **Resource group**: enter the same resource group as you're using for the - container registry. The Docker Scout resources must be deployed to the - same resource group as the registry. - - - **Registry name**: the field is pre-filled with the subdomain of the - registry hostname. - -6. Select **Review + create**, and then **Create** to deploy the template. - -7. Wait until the deployment is complete. -8. In the **Deployment details** section click on the newly created resource - of the type **Container registry token**. Generate a new password for this token. - - Alternatively, use the search function in Azure to navigate to the - **Container registry** resource that you're looking to integrate, and - generate the new password for the created access token. - -9. Copy the generated password and head back to the Docker Scout Dashboard to - finalize the integration. - -10. Paste the generated password into the **Registry token** field. -11. Select **Enable integration**. - -After selecting **Enable integration**, Docker Scout performs a connection test -to verify the integration. If the verification was successful, you're -redirected to the Azure registry summary page, which shows you all your Azure -integrations for the current organization. - -Next, activate Docker Scout for the repositories that you want to analyze in -[Repository settings](https://scout.docker.com/settings/repos/). - -After activating repositories, images that you push are analyzed by Docker -Scout. The analysis results appear in the Docker Scout Dashboard. -If your repository already contains images, Docker Scout pulls and analyzes the -latest image version automatically. - -## Remove an integration - -> [!IMPORTANT] -> -> Removing the integration in the Docker Scout Dashboard doesn't automatically -> remove the resources created in Azure. - -To remove an ACR integration: - -1. Go to the [ACR integration page](https://scout.docker.com/settings/integrations/azure/) - on the Docker Scout Dashboard. -2. Find the ACR integration that you want to remove, and select the **Remove** - button. -3. In the dialog that opens, confirm by selecting **Remove**. -4. After removing the integration in the Docker Scout Dashboard, also remove - the Azure resources related to the integration: - - - The `docker-scout-readonly-token` token for the container registry. - - The `docker-scout-repository` Event Grid System Topic. - -## Migrate from the ACR integration - -Two migration paths are available. - -### Continuous polling - -Best for teams that want ongoing, registry-wide analysis without changing -their build pipelines. `docker scout watch` runs as a long-running process -that polls your ACR registry and pushes results to Docker Scout, replicating -what the integration provided. - -1. Pick a host on which to run `docker scout watch`. - - The host must have network access to your ACR registry and be able to - access the Scout API (`https://api.scout.docker.com`) over the internet. - -2. Ensure you are running the latest version of Scout. - - ```console - $ docker scout version - ``` - - If necessary, [install the latest version of Scout](https://docs.docker.com/scout/install/). - -3. Authenticate Docker to your ACR registry. - - ```console - $ docker login .azurecr.io \ - --username \ - --password - ``` - - > [!TIP] - > - > As a best practice, create a dedicated service principal or token with - > read-only (pull) access to the registry. - -4. Set up your Scout credentials. - - 1. Generate an organization access token. For more details, see - [Create an organization access token](/enterprise/security/access-tokens/#create-an-organization-access-token). - 2. Sign in to Docker using the organization access token. - - ```console - $ docker login --username - ``` - - When prompted for a password, paste the organization access token. - - 3. Connect your local Docker environment to your organization's Docker Scout service. - - ```console - $ docker scout enroll - ``` - -5. Index existing images. You only need to do this once. - - Run `docker scout watch` with the `--all-images` flag to backfill all - existing images in the registry. - - ```console - $ docker scout watch \ - --org \ - --registry .azurecr.io \ - --all-images - ``` - -6. Confirm the images have been indexed by viewing them on the - [Scout Dashboard](https://scout.docker.com/). - -7. Continuously watch for new images. - - Run `docker scout watch` to poll for new images going forward. Use - `--interval` (default 60 seconds) to control polling frequency, and - `--repository` and `--tag` to narrow scope. - - ```console - $ docker scout watch \ - --org \ - --registry .azurecr.io \ - --refresh-registry - ``` - - `docker scout watch` is a long-running process. Run it as a system - service, for example using `systemd` or `nohup`, to ensure it continues - running in the background. - -Reference: [`docker scout watch`](/reference/cli/docker/scout/watch/) - -### Build-time analysis in CI - -Best for teams that already have CI pipelines and want analysis scoped to -images they actively build and push. No long-running process required. - -After `docker build` in your pipeline, run: - -- `docker scout quickview` or `docker scout cves` to analyze the image. -- `docker scout compare --to-env ` for PR gating against policy. -- `docker scout environment` to record the image to an environment. - -See [Integrating Docker Scout with CI](../_index.md#continuous-integration). diff --git a/content/manuals/scout/integrations/registry/artifactory.md b/content/manuals/scout/integrations/registry/artifactory.md deleted file mode 100644 index 36cb7f2ffcb1..000000000000 --- a/content/manuals/scout/integrations/registry/artifactory.md +++ /dev/null @@ -1,167 +0,0 @@ ---- -description: Integrate Artifactory Container Registry with Docker Scout -keywords: docker scout, artifactory, integration, image analysis, security, cves -title: Integrate Docker Scout with Artifactory Container Registry -linkTitle: Artifactory Container Registry -aliases: - - /scout/artifactory/ ---- - -Integrating Docker Scout with JFrog Artifactory lets you index and analyze -images from Artifactory. This integration is powered by a long-running -`docker scout watch` process. It pulls images from your selected repositories -(optionally filtered), can receive webhook callbacks from Artifactory, and -pushes image data to Docker Scout. View results in the Docker Scout Dashboard or -with `docker scout` CLI. - -## How it works - -You run [`docker scout watch`](/reference/cli/docker/scout/watch/) on a host you -control and configure the Artifactory-specific registry string via `--registry -"key=value,..."`. The watch process can: - -- Watch specific repositories or an entire registry -- Optionally ingest all existing images once -- Periodically refresh repository lists -- Receive webhook callbacks from Artifactory on a local port you choose - -After the integration, Docker Scout automatically pulls and analyzes images -that you push to the Artifactory registry. Metadata about your images are stored on the -Docker Scout platform, but Docker Scout doesn't store the container images -themselves. For more information about how Docker Scout handles image data, see -[Data handling](/manuals/scout/deep-dive/data-handling.md). - -### Artifactory-specific registry string options - -These `type=artifactory` options override the generic registry handling for the `--registry` option: - -| Key | Required | Description | -|------------------|:--------:|----------------------------------------------------------------------------------------| -| `type` | Yes | Must be `artifactory`. | -| `registry` | Yes | Docker/OCI registry hostname (e.g., `example.jfrog.io`). | -| `api` | Yes | Artifactory REST API base URL (e.g., `https://example.jfrog.io/artifactory`). | -| `repository` | Yes | Repository to watch (replaces `--repository`). | -| `includes` | No | Globs to include (e.g., `*/frontend*`). | -| `excludes` | No | Globs to exclude (e.g., `*/legacy/*`). | -| `port` | No | Local port to listen on for webhook callbacks. | -| `subdomain-mode` | No | `true` or `false`; matches Artifactory’s Docker layout (subdomain versus repository-path). | - -## Integrate an Artifactory registry - -Use the following steps to integrate your Artifactory registry with Docker -Scout. - -1. Pick the host on which to run `docker scout watch`. - - The host must have local or network access to your private registry and be able - to access the Scout API (`https://api.scout.docker.com`) over the internet. If - you're using webhook callbacks, Artifactory must also be able to reach the Scout - client host on the configured port. - Override the `--workers` option (default: `3`) for optimal performance based on - the size of the host and the expected workload. - -2. Ensure you are running the latest version of Scout. - - Check your current version: - - ```console - $ docker scout version - ``` - - If necessary, [install the latest version of Scout](https://docs.docker.com/scout/install/). - -3. Set up your Artifactory credentials. - - Store the credentials that the Scout client will use to authenticate with - Artifactory. The following is an example using environment variables. Replace - `` and `` with your actual values. - - ```console - $ export DOCKER_SCOUT_ARTIFACTORY_API_USER= - $ export DOCKER_SCOUT_ARTIFACTORY_API_PASSWORD= - ``` - - > [!TIP] - > - > As a best practice, create a dedicated user with read-only access and use - > an access token instead of a password. - - Store the credential that Artifactory will use to authenticate webhook - callbacks. The following is an example using an environment variable. Replace - `` with an actual secret. - - ```console - $ export DOCKER_SCOUT_ARTIFACTORY_WEBHOOK_SECRET= - ```` - - > [!TIP] - > - > As a best practice, generate a high-entropy random string of 64-128 characters. - -4. Set up your Scout credentials. - - 1. Generate an organization access token for accessing Scout. For more - details, see [Create an organization access - token](/enterprise/security/access-tokens/#create-an-organization-access-token). - 2. Sign in to Docker using the organization access token. - - ```console - $ docker login --username - ``` - - When prompted for a password, paste the organization access token you - generated. - - 3. Connect your local Docker environment to your organization's Docker Scout service. - - ```console - $ docker scout enroll - ``` - -5. Index existing images. You only need to do this once. - - Run `docker scout watch` with the `--all-images` option to index all images in the specified Artifactory repository. The following is an example command: - - ```console - $ docker scout watch --registry \ - "type=artifactory,registry=example.jfrog.io,api=https://example.jfrog.io/artifactory,include=*/frontend*,exclude=*/dta/*,repository=docker-local,port=9000,subdomain-mode=true" \ - --all-images - ``` - -6. Confirm the images have been indexed by viewing them on the [Scout - Dashboard](https://scout.docker.com/). - -7. Configure Artifactory callbacks. - - In your Artifactory UI or via REST API, configure webhooks for image - push/update events. Set the endpoint to your `docker scout watch` host and - port, and include the `DOCKER_SCOUT_ARTIFACTORY_WEBHOOK_SECRET` for - authentication. - - For more information, see the [JFrog Artifactory Webhooks - documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/webhooks) - or the [JFrog Artifactory REST API Webhooks - documentation](https://jfrog.com/help/r/jfrog-rest-apis/webhooks). - -8. Continuously watch for new or updated images. - - Run `docker scout watch` with the `--refresh-registry` option to watch for - new images to index. - - The `docker scout watch` command is a long-running process that must - continue running indefinitely in the background to receive webhooks and - watch for new images. If you run it directly in a terminal and close the - session, the process will stop. - - The following is an example command. You can run the process as a system - service, for example using `systemd` or `nohup`, to ensure it continues - running in the background. - - ```console - $ docker scout watch --registry \ - "type=artifactory,registry=example.jfrog.io,api=https://example.jfrog.io/artifactory,include=*/frontend*,exclude=*/dta/*,repository=docker-local,port=9000,subdomain-mode=true" \ - --refresh-registry - ``` - -9. Optional. Set up Scout integration for real-time notifications from popular - collaboration platforms. \ No newline at end of file diff --git a/content/manuals/scout/integrations/registry/ecr.md b/content/manuals/scout/integrations/registry/ecr.md deleted file mode 100644 index a326e485434e..000000000000 --- a/content/manuals/scout/integrations/registry/ecr.md +++ /dev/null @@ -1,291 +0,0 @@ ---- -description: Integrate Amazon Elastic Container Registry with Docker Scout -keywords: docker scout, ecr, integration, image analysis, security, cves -title: Integrate Docker Scout with Amazon ECR -linkTitle: Amazon ECR -params: - sidebar: - badge: - color: gray - text: Deprecated ---- - -> [!IMPORTANT] -> -> The Docker Scout Amazon ECR integration is deprecated and will be retired on September 1, 2026. -> Migrate to [`docker scout watch`](/reference/cli/docker/scout/watch/) for -> continuous analysis, or integrate Scout into your CI pipeline. -> See [Migrate from the ECR integration](#migrate-from-the-ecr-integration). - -Integrating Docker Scout with Amazon Elastic Container Registry (ECR) lets you -view image insights for images hosted in ECR repositories. After integrating -Docker Scout with ECR and activating Docker Scout for a repository, pushing an -image to the repository automatically triggers image analysis. You can view -image insights using the Docker Scout Dashboard, or the `docker scout` CLI -commands. - -## How it works - -To help you integrate Docker Scout with ECR, you can use a CloudFormation stack -template that creates and configures the necessary AWS resources for -integrating Docker Scout with your ECR registry. For more details about the AWS -resources, see [CloudFormation stack template](#cloudformation-stack-template). - -The following diagram shows how the Docker Scout ECR integration works. - -![How the ECR integration works](../../images/Scout-ECR.png) - -After the integration, Docker Scout automatically pulls and analyzes images -that you push to the ECR registry. Metadata about your images are stored on the -Docker Scout platform, but Docker Scout doesn't store the container images -themselves. For more information about how Docker Scout handles image data, see -[Data handling](/manuals/scout/deep-dive/data-handling.md). - -### CloudFormation stack template - -The following table describes the configuration resources. - -> [!NOTE] -> -> Creating these resources incurs a small, recurring cost on the AWS account. -> The **Cost** column in the table represents an estimated monthly cost of the -> resources, when integrating an ECR registry that gets 100 images pushed per day. -> -> Additionally, an egress cost also applies when Docker Scout pulls the images -> from ECR. The egress cost is around $0.09 per GB. - -| Resource type | Resource name | Description | Cost | -| ----------------------------- | ----------------------------- | ------------------------------------------------------------------------------------------ | ----- | -| `AWS::SNSTopic::Topic` | `SNSTopic` | SNS topic for notifying Docker Scout when the AWS resources have been created. | Free | -| `AWS::SNS::TopicPolicy` | `TopicPolicy` | Defines the topic for the initial setup notification. | Free | -| `AWS::SecretsManager::Secret` | `ScoutAPICredentials` | Stores the credentials used by EventBridge to fire events to Scout. | $0.42 | -| `AWS::Events::ApiDestination` | `ApiDestination` | Sets up the EventBridge connection to Docker Scout for sending ECR push and delete events. | $0.01 | -| `AWS::Events::Connection` | `Connection` | EventBridge connection credentials to Scout. | Free | -| `AWS::Events::Rule` | `DockerScoutEcrRule` | Defines the rule to send ECR pushes and deletes to Scout. | Free | -| `AWS::Events::Rule` | `DockerScoutRepoDeletedRule` | Defines the rule to send ECR repository deletes to Scout. | Free | -| `AWS::IAM::Role` | `InvokeApiRole` | Internal role to grant the event access to `ApiDestination`. | Free | -| `AWS::IAM::Role` | `AssumeRoleEcrAccess` | This role has access to `ScoutAPICredentials` for setting up the Docker Scout integration. | Free | - -## Integrate your first registry - -Create the CloudFormation stack in your AWS account to enable the Docker Scout -integration. - -Prerequisites: - -- You must have access to an AWS account with permission to create resources. -- You have be an owner of the Docker organization. - -To create the stack: - -1. Go to the [ECR integration page](https://scout.docker.com/settings/integrations/ecr/) - on the Docker Scout Dashboard. -2. Select the **Create on AWS** button. - - This opens the **Create stack** wizard in the AWS CloudFormation console in - a new browser tab. If you're not already signed in to AWS, you're redirected - to the sign-in page first. - - If the button is grayed-out, it means you're lacking the necessary - permissions in the Docker organization. - -3. Follow the steps in the **Create stack** wizard until the end. Choose the - AWS region you want to integrate. Complete the procedure by creating the - resources. - - The fields in the wizard are pre-populated by the CloudFormation template, - so you don't need to edit any of the fields. - -4. When the resources have been created (the CloudFormation status shows - `CREATE_COMPLETE` in the AWS console), return to the ECR integrations page - in the Docker Scout Dashboard. - - The **Integrated registries** list shows the account ID and region for the - ECR registry that you just integrated. If successful, the integration status - is **Connected**. - -The ECR integration is now active. For Docker Scout to start analyzing images -in the registry, you need to activate it for each repository in -[Repository settings](https://scout.docker.com/settings/repos/). - -After activating repositories, images that you push are analyzed by Docker -Scout. The analysis results appear in the Docker Scout Dashboard. -If your repository already contains images, Docker Scout pulls and analyzes the -latest image version automatically. - -## Integrate additional registries - -To add additional registries: - -1. Go to the [ECR integration page](https://scout.docker.com/settings/integrations/ecr/) - on the Docker Scout Dashboard. -2. Select the **Add** button at the top of the list. -3. Complete the steps for creating the AWS resources. -4. When the resources have been created, return to the ECR integrations page in - the Docker Scout Dashboard. - - The **Integrated registries** list shows the account ID and region for the - ECR registry that you just integrated. If successful, the integration status - is **Connected**. - -Next, activate Docker Scout for the repositories that you want to analyze in -[Repository settings](https://scout.docker.com/settings/repos/). - -## Remove integration - -To remove an integrated ECR registry, you must be an owner of the Docker -organization. - -1. Go to the [ECR integration page](https://scout.docker.com/settings/integrations/ecr/) - on the Docker Scout Dashboard. -2. Find the registry that you want to remove in the list of integrated - registries, and select the remove icon in the **Actions** column. - - If the remove icon is disabled, it means that you're lacking the necessary - permissions in the Docker organization. - -3. In the dialog that opens, confirm by selecting **Remove**. - -> [!IMPORTANT] -> -> Removing the integration from the Docker Scout dashboard doesn't remove the -> AWS resources in your account. -> -> After removing the integration in Docker Scout, go to the AWS console and -> delete the **DockerScoutECRIntegration** CloudFormation stack for the integration -> that you want to remove. - -## Troubleshooting - -### Unable to integrate registry - -Check the **Status** of the integration on the [ECR integration page](https://scout.docker.com/settings/integrations/ecr/) -in the Docker Scout Dashboard. - -- If the status is **Pending** for a prolonged period of time, it's an - indication that the integration was not yet completed on the AWS side. Select - the **Pending** link to open the CloudFormation wizard, and complete all the - steps. - -- An **Error** status indicates that something's gone wrong in the back-end. - You can try [removing the integration](#remove-integration) and recreating it - again. - -### ECR images not showing in the dashboard - -If image analysis results for your ECR images aren't showing up in the Docker -Scout Dashboard: - -- Ensure that you've activated Docker Scout for the repository. View and manage - active repositories in [Repository settings](https://scout.docker.com/settings/repos/). - -- Ensure that the AWS account ID and region for your registry is listed on the - ECR integrations page. - - The account ID and region are included in the registry hostname: - `.dkr.ecr..amazonaws.com/` - -## Migrate from the ECR integration - -Two migration paths are available. - -### Continuous polling - -Best for teams that want ongoing, registry-wide analysis without changing -their build pipelines. `docker scout watch` runs as a long-running process -that polls your ECR registry and pushes results to Docker Scout, replicating -what the integration provided. - -1. Pick a host on which to run `docker scout watch`. - - The host must have network access to your ECR registry and be able to - access the Scout API (`https://api.scout.docker.com`) over the internet. - -2. Ensure you are running the latest version of Scout. - - ```console - $ docker scout version - ``` - - If necessary, [install the latest version of Scout](https://docs.docker.com/scout/install/). - -3. Authenticate Docker to your ECR registry using the AWS CLI. - - ```console - $ aws ecr get-login-password --region | \ - docker login --username AWS --password-stdin \ - .dkr.ecr..amazonaws.com - ``` - - The AWS identity used must have at least `ecr:GetAuthorizationToken` and - `ecr:BatchGetImage` permissions on the target registry. - - > [!TIP] - > - > As a best practice, use a dedicated IAM role or user with read-only - > access to the registry. - -4. Set up your Scout credentials. - - 1. Generate an organization access token. For more details, see - [Create an organization access token](/enterprise/security/access-tokens/#create-an-organization-access-token). - 2. Sign in to Docker using the organization access token. - - ```console - $ docker login --username - ``` - - When prompted for a password, paste the organization access token. - - 3. Connect your local Docker environment to your organization's Docker Scout service. - - ```console - $ docker scout enroll - ``` - -5. Index existing images. You only need to do this once. - - Run `docker scout watch` with the `--all-images` flag to backfill all - existing images in the registry. - - ```console - $ docker scout watch \ - --org \ - --registry .dkr.ecr..amazonaws.com \ - --all-images - ``` - -6. Confirm the images have been indexed by viewing them on the - [Scout Dashboard](https://scout.docker.com/). - -7. Continuously watch for new images. - - Run `docker scout watch` to poll for new images going forward. Use - `--interval` (default 60 seconds) to control polling frequency, and - `--repository` and `--tag` to narrow scope. - - ```console - $ docker scout watch \ - --org \ - --registry .dkr.ecr..amazonaws.com \ - --refresh-registry - ``` - - `docker scout watch` is a long-running process. Run it as a system - service, for example using `systemd` or `nohup`, to ensure it continues - running in the background. - -Reference: [`docker scout watch`](/reference/cli/docker/scout/watch/) - -### Build-time analysis in CI - -Best for teams that already have CI pipelines and want analysis scoped to -images they actively build and push. No long-running process required. - -After `docker build` in your pipeline, run: - -- `docker scout quickview` or `docker scout cves` to analyze the image. -- `docker scout compare --to-env ` for PR gating against policy. -- `docker scout environment` to record the image to an environment. - -See [Integrating Docker Scout with CI](../_index.md#continuous-integration). diff --git a/content/manuals/scout/integrations/source-code-management/_index.md b/content/manuals/scout/integrations/source-code-management/_index.md deleted file mode 100644 index aded6d7584e4..000000000000 --- a/content/manuals/scout/integrations/source-code-management/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -build: - render: never -title: Source code management ---- diff --git a/content/manuals/scout/integrations/source-code-management/github.md b/content/manuals/scout/integrations/source-code-management/github.md deleted file mode 100644 index 7f771fda4b61..000000000000 --- a/content/manuals/scout/integrations/source-code-management/github.md +++ /dev/null @@ -1,59 +0,0 @@ ---- -title: Integrate Docker Scout with GitHub -linkTitle: GitHub -description: Integrate Docker Scout using the GitHub app to get remediation advice directly in your repositories -keywords: scout, github, integration, image analysis, supply chain, remediation, source code -params: - sidebar: - badge: - color: gray - text: Retired ---- - -> [!IMPORTANT] -> -> The Docker Scout GitHub integration was retired on July 1, 2026. For base-image updates, use -> GitHub Dependabot with `package-ecosystem: "docker"`. For image-to-source -> linkage, build with `--provenance=mode=max`. - -> [!NOTE] -> -> This retirement applies only to the Docker Scout GitHub App integration. -> The [`docker/scout-action`](https://github.com/docker/scout-action) GitHub -> Action for CI pipelines is not affected and continues to work. - -## Migrate from the GitHub integration - -The integration provided two capabilities, each with an alternative. - -### Base-image digest repinning - -Use GitHub Dependabot with `package-ecosystem: "docker"`. Dependabot opens -PRs to update base image tags and digests on a schedule. When you pin as -`FROM image:tag@sha256:...`, both the tag and digest are updated. The Scout -integration updated only the digest. - -Minimal `.github/dependabot.yml`: - -```yaml -version: 2 -updates: - - package-ecosystem: "docker" - directory: "/" - schedule: - interval: "weekly" -``` - -See [Configuring Dependabot version updates](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuring-dependabot-version-updates). - -### Image-to-source linkage - -Build with `--provenance=mode=max`. Docker Scout reads the resulting provenance -attestation to link an image back to its source repository without requiring -the GitHub app. - -```console -$ docker build --provenance=mode=max -t myimage:tag . -``` - -See [SLSA provenance attestations](/manuals/build/metadata/attestations/slsa-provenance.md). diff --git a/content/manuals/scout/integrations/team-collaboration/_index.md b/content/manuals/scout/integrations/team-collaboration/_index.md deleted file mode 100644 index 61a9f8b0040c..000000000000 --- a/content/manuals/scout/integrations/team-collaboration/_index.md +++ /dev/null @@ -1,5 +0,0 @@ ---- -build: - render: never -title: Team collaboration ---- diff --git a/content/manuals/scout/integrations/team-collaboration/slack.md b/content/manuals/scout/integrations/team-collaboration/slack.md deleted file mode 100644 index 6cd8210352ad..000000000000 --- a/content/manuals/scout/integrations/team-collaboration/slack.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Integrate Docker Scout with Slack -linkTitle: Slack -description: | - Integrate Docker Scout with Slack to receive real-time updates - about vulnerabilities and policy compliance in Slack channels -keywords: scout, team collaboration, slack, notifications, updates -params: - sidebar: - badge: - color: gray - text: Deprecated ---- - -> [!IMPORTANT] -> -> The Docker Scout Slack integration is deprecated and will be retired on -> July 30, 2026. To surface CVE and policy results without push notifications, -> integrate `docker scout cves` or `docker scout policy` into your CI pipeline. -> See [CI integrations](/manuals/scout/integrations/_index.md#continuous-integration). -> For details, see the -> [Scout platform release notes](/manuals/scout/release-notes/platform.md). - -You can integrate Docker Scout with Slack by creating a Slack webhook and -adding it to the Docker Scout Dashboard. Docker Scout will notify you about -when a new vulnerability is disclosed, and it affects one or more of your -images. - -![Slack notification from Docker Scout](../../images/scout-slack-notification.png?border=true "Example Slack notification from Docker Scout") - -## How it works - -After configuring the integration, Docker Scout sends notifications about -changes to policy compliance and vulnerability exposure for your repositories, -to the Slack channels associated with the webhook. - -> [!NOTE] -> -> Notifications are only triggered for the *last pushed* image tags for each -> repository. "Last pushed" refers to the image tag that was most recently -> pushed to the registry and analyzed by Docker Scout. If the last pushed image -> is not affected by a newly disclosed CVE, then no notification will be triggered. - -For more information about Docker Scout notifications, -see [Notification settings](/manuals/scout/explore/dashboard.md#notification-settings). - -## Setup - -To add a Slack integration: - -1. Create a webhook, see [Slack documentation](https://api.slack.com/messaging/webhooks). -2. Go to the [Slack integration page](https://scout.docker.com/settings/integrations/slack/) in the Docker Scout Dashboard. -3. In the **How to integrate** section, enter a **Configuration name**. - Docker Scout uses this label as a display name for the integration, - so you might want to change the default name into something more meaningful. - For example the `#channel-name`, or the name of the team that this configuration belongs to. -4. Paste the webhook you just created in the **Slack webhook** field. - - Select the **Test webhook** button if you wish to verify the connection. - Docker Scout will send a test message to the specified webhook. - -5. Select whether you want to enable notifications for all your Scout-enabled image repositories, - or enter the names of the repositories that you want to send notifications for. -6. When you're ready to enable the integration, select **Create**. - -After creating the webhook, Docker Scout begins to send notification updates -to the Slack channels associated with the webhook. - -## Remove a Slack integration - -To remove a Slack integration: - -1. Go to the [Slack integration page](https://scout.docker.com/settings/integrations/slack/) in the Docker Scout Dashboard. -2. Select the **Remove** icon for the integration that you want to remove. -3. Confirm by selecting **Remove** again in the confirmation dialog. diff --git a/content/manuals/scout/policy/_index.md b/content/manuals/scout/policy/_index.md index 4465ea9f41bd..89d12b7bfeae 100644 --- a/content/manuals/scout/policy/_index.md +++ b/content/manuals/scout/policy/_index.md @@ -120,17 +120,3 @@ attestations at build time: ```console $ docker buildx build --provenance=true -t --push . ``` - -## Policies page in the Dashboard - -> [!IMPORTANT] -> -> The `docker scout policy` command brings policy evaluation directly to your -> CLI so you can evaluate any image locally, in CI, or with custom policies -> without needing the Dashboard. The Policies page in the Dashboard is -> deprecated and will be retired on September 1, 2026. See -> [Evaluate policies](./local.md). - -The Docker Scout Dashboard previously provided a visual interface for tracking -policy compliance across your organization's images. See -[Use the Policies page in the Dashboard](./dashboard.md). diff --git a/content/manuals/scout/policy/dashboard.md b/content/manuals/scout/policy/dashboard.md deleted file mode 100644 index 0426c3a40863..000000000000 --- a/content/manuals/scout/policy/dashboard.md +++ /dev/null @@ -1,233 +0,0 @@ ---- -title: Use the Policies page in the Dashboard -linkTitle: Use the Dashboard -description: View policy status, configure policies, and get remediation advice using the Docker Scout Dashboard -keywords: scout, policy, dashboard, configure, remediation, status -params: - sidebar: - badge: - color: gray - text: Deprecated -aliases: - - /scout/policy/ci/ - - /scout/policy/view/ - - /scout/policy/configure/ - - /scout/policy/remediation/ ---- - -> [!IMPORTANT] -> -> The Policies page is deprecated and will be retired on September 1, 2026. -> The `docker scout policy` command replaces this with more options for -> evaluating policies. You can run evaluations locally, in CI, against custom -> Rego policies, or using OCI bundles. See -> [Evaluate policies](./local.md). - -## View policy status - -The **Overview** tab of the [Docker Scout Dashboard](https://scout.docker.com/) -displays a summary of recent changes in policy for your repositories. -This summary shows images that have seen the most change in their policy -evaluation between the most recent image and the previous image. - -### Policy status per repository - -The **Images** tab shows the current policy status, and recent policy trend, -for all images in the selected environment. The **Policy status** column shows: - -- Number of fulfilled policies versus the total number of policies -- Recent policy trends - -The policy trend, denoted by the directional arrows, indicates whether an image -is better, worse, or unchanged compared to the previous image in the same -environment. - -- The green arrow pointing upwards shows the number of policies that improved. -- The red arrow pointing downwards shows the number of policies that worsened. -- The bidirectional gray arrow shows the number of policies that were unchanged. - -### Detailed results - -To view the full evaluation results for an image, navigate to the image tag in -the Docker Scout Dashboard and open the **Policy** tab. - -For vulnerability-related policies, the details view shows the fix version when -one is available. For licensing-related policies, the list shows all packages -whose license doesn't meet the policy criteria. - -## Configure policies - -Some policy types are configurable. You can create customized versions with -your own parameters, disable a policy, or delete it. - -> [!NOTE] -> Historic evaluation results for the default policy configuration are removed -> if you delete or customize a policy. - -### Add a policy - -1. Go to the [Policies page](https://scout.docker.com/reports/policy) in the Docker Scout Dashboard. -2. Select **Add policy**. -3. Locate the policy type you want to configure and select **Configure**. - - - If **Configure** is grayed out, the policy has no configurable parameters. - - If the button reads **Integrate**, setup is required before the policy can be enabled. - -4. Update the policy parameters. -5. Select **Save policy** to enable, or **Save and disable** to save without enabling. - -### Edit a policy - -1. Go to the [Policies page](https://scout.docker.com/reports/policy). -2. Select the policy and then select **Edit**. -3. Update the parameters and save. - -### Disable a policy - -Disabling a policy hides its results but doesn't delete historic data. - -1. Go to the [Policies page](https://scout.docker.com/reports/policy). -2. Select the policy and then select **Disable**. - -### Delete a policy - -Deleting a policy removes its evaluation results. - -1. Go to the [Policies page](https://scout.docker.com/reports/policy). -2. Select the policy and then select **Delete**. - -To recreate a deleted policy, follow [Add a policy](#add-a-policy) and select -**Configure** on the deleted policy type. - -## Remediation - -Docker Scout provides remediation recommendations based on policy evaluation -results. Recommendations are available for the following policy types: - -- [Up-to-Date Base Images](#up-to-date-base-images) -- [Supply Chain Attestations](#supply-chain-attestations) - -To view recommendations: - -1. Go to the [Policies page](https://scout.docker.com/reports/policy). -2. Select a policy. -3. Hover over an image in the list and select **View fixes**. - -If more than one recommendation is available, the primary recommendation -displays as the **Recommended fix**. Additional recommendations are listed as -**Quick fixes**. - -### Up-to-Date Base Images - -Without provenance attestations, compliance is undeterminable. Add -[provenance attestations](/manuals/build/metadata/attestations/slsa-provenance.md) -so Docker Scout can detect the base image version you're using. - -With provenance attestations, the recommended action shows how to update your -base image to the latest version and pin it to a specific digest. See -[Pin base image versions](/manuals/build/building/best-practices.md#pin-base-image-versions). - -With the GitHub integration enabled, you can raise a pull request directly from -the remediation panel to update the base image version in your Dockerfile. - -### Supply Chain Attestations - -The **Supply Chain Attestations** policy requires SBOM and provenance -attestations. The remediation panel shows what's missing. For example, if your -image has a provenance attestation without enough information, rebuild with -[`mode=max`](/manuals/build/metadata/attestations/slsa-provenance.md#max) provenance. - -## Evaluate policy compliance in CI - -Adding policy evaluation to your CI pipelines helps you detect and prevent -cases where a change would cause policy compliance to worsen compared to your -baseline. - -The recommended strategy involves evaluating a local image and comparing the -results to a baseline using an [environment](../integrations/environment/_index.md). -If policy compliance for the new image is worse than the baseline, the CI run -fails. If compliance is better or unchanged, the run succeeds. - -The following GitHub Actions example uses the [Docker Scout GitHub Action](https://github.com/marketplace/actions/docker-scout) -to compare a pull request image against the `production` environment. The -`exit-on` input is set to `policy`, so the step fails only if policy compliance -has worsened. - -> [!NOTE] -> -> Due to a limitation in Docker Engine, loading multi-platform images or images -> with attestations to the image store isn't supported. Build a single-platform -> image without attestations and load it for the policy evaluation to work. - -```yaml -name: Docker - -on: - push: - tags: ["*"] - branches: - - "main" - pull_request: - branches: ["**"] - -env: - REGISTRY: docker.io - IMAGE_NAME: - DOCKER_ORG: - -jobs: - build: - permissions: - pull-requests: write - - runs-on: ubuntu-latest - steps: - - name: Log into registry ${{ env.REGISTRY }} - uses: docker/login-action@{{% param "login_action_version" %}} - with: - registry: ${{ env.REGISTRY }} - username: ${{ secrets.REGISTRY_USER }} - password: ${{ secrets.REGISTRY_TOKEN }} - - - name: Setup Docker buildx - uses: docker/setup-buildx-action@{{% param "setup_buildx_action_version" %}} - - - name: Extract metadata - id: meta - uses: docker/metadata-action@{{% param "metadata_action_version" %}} - with: - images: ${{ env.IMAGE_NAME }} - - - name: Build image - id: build-and-push - uses: docker/build-push-action@{{% param "build_push_action_version" %}} - with: - tags: ${{ steps.meta.outputs.tags }} - labels: ${{ steps.meta.outputs.labels }} - sbom: ${{ github.event_name != 'pull_request' }} - provenance: ${{ github.event_name != 'pull_request' }} - push: ${{ github.event_name != 'pull_request' }} - load: ${{ github.event_name == 'pull_request' }} - - - name: Authenticate with Docker - uses: docker/login-action@{{% param "login_action_version" %}} - with: - username: ${{ secrets.DOCKER_USER }} - password: ${{ secrets.DOCKER_PAT }} - - - name: Compare - if: ${{ github.event_name == 'pull_request' }} - uses: docker/scout-action@v1 - with: - command: compare - image: ${{ steps.meta.outputs.tags }} - to-env: production - platform: "linux/amd64" - ignore-unchanged: true - only-severities: critical,high - organization: ${{ env.DOCKER_ORG }} - exit-on: policy -``` - -For other CI platforms, see -[Docker Scout CI integrations](../integrations/_index.md#continuous-integration). diff --git a/content/manuals/scout/policy/local.md b/content/manuals/scout/policy/local.md index 1a14ab68a480..a809b41aa805 100644 --- a/content/manuals/scout/policy/local.md +++ b/content/manuals/scout/policy/local.md @@ -2,6 +2,12 @@ title: Evaluate policies description: Evaluate Docker Scout policies using the CLI, with built-in and custom Rego policies keywords: scout, policy, rego, opa, cli, custom policies, policy bundle +aliases: + - /scout/policy/dashboard/ + - /scout/policy/ci/ + - /scout/policy/view/ + - /scout/policy/configure/ + - /scout/policy/remediation/ --- {{< summary-bar feature_name="Evaluate policies" >}} @@ -27,21 +33,7 @@ Policies come from three sources, which can be combined: - Local `.rego` files: for authoring and iterating on custom policies with `--policy-file` or `--policy-dir`. -## Migrate from Policy Evaluation in the Dashboard - -If you used the Policies page in the Docker Scout Dashboard, `docker scout -policy` provides the same capability from the CLI. The built-in policies are -the same set. To evaluate an image: - -```console -$ docker scout policy -``` - -If you had customized policies in the dashboard, such as adjusted severity -thresholds or disabled policies, you can replicate those settings with a -`--policy-config` file. See [Configure built-in policies](#configure-built-in-policies). - -### Use in CI +## Use in CI Use the [Docker Scout GitHub Action](https://github.com/marketplace/actions/docker-scout) to evaluate policies as part of your workflow: @@ -59,15 +51,11 @@ For other CI platforms, install the [Docker Scout CLI plugin](/manuals/scout/install.md) on your runner and run `docker scout policy --exit-code`. -### Migrate the GitHub Action from dashboard-based policy evaluation - -The Docker Scout GitHub Action now supports the same local policy configuration -flags as `docker scout policy`. If you used `compare --exit-on policy` with -dashboard-managed policy settings, replicate those settings locally with -`--policy-config`: +To gate a build on policy compliance compared to an environment, use the +`compare` command with a policy configuration: ```yaml -- uses: docker/scout-action@v1.23.0 +- uses: docker/scout-action@v1 with: command: compare image: ${{ env.IMAGE_NAME }} diff --git a/content/manuals/scout/release-notes/platform.md b/content/manuals/scout/release-notes/platform.md index e2d9e856b5b4..be912789083a 100644 --- a/content/manuals/scout/release-notes/platform.md +++ b/content/manuals/scout/release-notes/platform.md @@ -17,6 +17,32 @@ Docker Scout platform, including the Dashboard. For CLI release notes, refer to ## Q2 2026 +### 2026-09-01 + +The following Docker Scout features were retired: + +- Notifications: In-product and email notifications about newly disclosed CVEs. + Integrate `docker scout cves` or `docker scout policy` into your CI pipeline + to surface vulnerability and policy results without push notifications. +- Native Amazon ECR integration: ECR is still supported using + [`docker scout watch`](../integrations/registry/_index.md) for continuous + polling, or by integrating Scout into your CI pipeline. +- Native Azure Container Registry integration: ACR is still supported using + the same options as ECR. +- Policies page in the Dashboard: The `docker scout policy` + command replaces this with more options for evaluating policies. You can run + evaluations locally, in CI, against custom Rego policies, or using OCI + bundles. See [Evaluate policies](../policy/local.md). +- SonarQube integration. + +### 2026-07-30 + +The following Docker Scout feature was retired: + +- Slack integration: Integrate `docker scout cves` or `docker scout policy` + into your CI pipeline to surface vulnerability and policy results without + push notifications. + ### 2026-07-01 The following Docker Scout features were retired: @@ -31,32 +57,23 @@ The following Docker Scout features were retired: - GitHub source code management integration: Migrate to GitHub Dependabot for base-image updates and build with `--provenance=mode=max` for image-to-source linkage. See - [GitHub integration](../integrations/source-code-management/github.md) + [Deprecated and retired products](/manuals/retired.md#docker-scout-features) for a migration guide. The following is deprecated and will be retired on July 30, 2026: - Slack integration: Vulnerability and policy compliance notifications to Slack - channels. Integrate `docker scout cves` or `docker scout policy` into your CI - pipeline as an alternative. See - [Slack integration](../integrations/team-collaboration/slack.md). + channels. The following are deprecated and will be retired on September 1, 2026: - Notifications: In-product and email notifications about newly disclosed CVEs. - Integrate `docker scout cves` or `docker scout policy` into your CI pipeline - to surface vulnerability and policy results without push notifications. - -- Amazon ECR integration: Migrate to - [`docker scout watch`](/reference/cli/docker/scout/watch/) for continuous - polling or integrate Scout into your CI pipeline. See - [ECR integration](../integrations/registry/ecr.md) for a migration guide. -- Azure Container Registry integration: Same migration options as ECR. See - [ACR integration](../integrations/registry/acr.md) for a migration guide. -- Policies page in the Dashboard: The `docker scout policy` - command replaces this with more options for evaluating policies. You can run - evaluations locally, in CI, against custom Rego policies, or using OCI - bundles. See [Evaluate policies](../policy/local.md). +- Amazon ECR integration: Automatically analyzed images pushed to ECR + registries. +- Azure Container Registry integration: Automatically analyzed images pushed + to ACR registries. +- Policies page in the Dashboard: Provided a visual interface in the Docker + Scout Dashboard for tracking policy compliance. - SonarQube integration. ## Q4 2024 @@ -179,7 +196,7 @@ making the now-removed **All critical vulnerabilities** policy redundant. [General Availability](../../release-lifecycle.md#general-availability-ga). For more information and setup instructions, see -[Integrate Azure Container Registry](../integrations/registry/acr.md). +Integrate Azure Container Registry. ### 2024-01-23 @@ -212,11 +229,10 @@ more precise recommendations. For more information about the types of recommendations that Docker Scout can provide to help you improve policy compliance, see -[Use the Dashboard](../policy/dashboard.md). +Use the Dashboard. For more information about how to authorize the Docker Scout GitHub app on your -source repositories, see -[Integrate Docker Scout with GitHub](../integrations/source-code-management/github.md). +source repositories, see Integrate Docker Scout with GitHub. ## Q4 2023 @@ -229,7 +245,7 @@ New features and enhancements released in the fourth quarter of 2023. [Early Access](../../release-lifecycle.md#early-access-ea). For more information and setup instructions, see -[Integrate Azure Container Registry](../integrations/registry/acr.md). +Integrate Azure Container Registry. ### 2023-12-06 @@ -247,7 +263,7 @@ Registry** (ACR) integration, which lets Docker Scout pull and analyze images in ACR repositories automatically. To learn more about the integration and how to get started, see -[Integrate Azure Container Registry](../integrations/registry/acr.md). +Integrate Azure Container Registry. ### 2023-11-21 @@ -260,7 +276,7 @@ policies for your organization include: - Customize the list of "high-profile vulnerabilities" - Add or remove software licenses to flag as "copyleft" -For more information, see [Configurable policies](../policy/dashboard.md). +For more information, see Configurable policies. ### 2023-11-10 @@ -320,8 +336,8 @@ metadata about the image contents, and not the container images themselves. The integration offers a straightforward process for adding additional repositories, activating Docker Scout for specific repositories, and removing -the integration if needed. To learn more, refer to the [Amazon ECR integration -documentation](../integrations/registry/ecr.md). +the integration if needed. To learn more, refer to the Amazon ECR integration +documentation. #### Sysdig integration diff --git a/data/redirects.yml b/data/redirects.yml index fb10cc31be83..1e6400a11b02 100644 --- a/data/redirects.yml +++ b/data/redirects.yml @@ -154,8 +154,9 @@ - /go/scout-policy-dsp006/ "/scout/policy/#approved-base-images": - /go/scout-policy-dsp007/ -"/scout/policy/#sonarqube-quality-gates": +"/retired/#docker-scout-features": - /go/scout-policy-dsp008/ + - "/go/scout-github/" "/scout/policy/configure/": - /go/scout-configure-policy/ "/build/building/best-practices/#pin-base-image-versions": @@ -173,7 +174,7 @@ - "/go/scout-circle-ci/" "/scout/integrations/ci/jenkins/": - "/go/scout-jenkins/" -"/scout/integrations/registry/artifactory": +"/scout/integrations/registry/": - /go/scout-artifactory/ "/scout/integrations/registry/ecr/": - "/go/scout-ecr/" @@ -185,8 +186,6 @@ - "/go/scout-acr/" "/scout/integrations/code-quality/sonarqube/": - "/go/scout-sq/" -"/scout/integrations/source-code-management/github/": - - "/go/scout-github/" "/scout/guides/vex/": - "/go/vex-guide/" "/scout/explore/metrics-exporter/":