Docker Scout Integration Guide

Integrate Docker Scout with Vulnetix. Scan container images for CVEs using Docker Scout and export SARIF findings or CycloneDX SBOMs for upload to Vulnetix.

Install & scan

$ # Docker Scout is included in Docker Desktop and Docker Engine 24.0+
docker scout version

# Or install the CLI plugin
curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh
$ # Scan for CVEs with SARIF output
docker scout cves myimage:latest --format sarif --output docker-scout.sarif

# Generate CycloneDX SBOM
docker scout sbom myimage:latest --format cyclonedx --output docker-scout.cdx.json

Run Docker Scout in CI

Scan on every push and upload the report as a workflow artifact:

- name: Build image
  run: docker build -t myapp:${{ github.sha }} .

- name: Scan with Docker Scout
  run: |
    docker scout cves myapp:${{ github.sha }}       --format sarif --output docker-scout.sarif

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: docker-scout
    path: docker-scout.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Docker Scout's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Docker Scout. Keep running it. Vulnetix sits on top of Docker Scout (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Docker Scout is strongest at its core category and also carries features in SCA, SBOM Generation, License Compliance, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Docker Scout does well

• Base-image recommendations that show which base-image upgrade removes the most CVEs, a genuinely useful, image-specific remediation signal
• Deeply integrated across Docker Hub, Docker Desktop, the CLI and a hosted dashboard, so scanning is one command away from where developers already work
• Policy evaluation engine plus CI/CD gating (GitHub Action) to enforce standards across an image portfolio
• Matches components against ~23 advisory sources (including CISA KEV and EPSS) and supports VEX statements to suppress non-exploitable CVEs

Where Vulnetix adds to it: Docker Scout is a strong container-native scanner but stays inside the Docker ecosystem and one image at a time. Vulnetix sits above it and every other scanner (SAST, IaC, secrets, cloud, SCA) to dedup findings into one prioritised queue, add Coalition ESS / CWSS / Vulnetix LEV prioritisation on top of the CVSS+EPSS+KEV Scout already provides, reachability, immutable versioned VEX with audit trail, SSVC policy and Safe Harbour autofix. Better together: Scout scans the image, Vulnetix orchestrates and prioritises its output alongside the rest of the estate.

No migration, no rip-and-replace. Docker Scout keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Docker Scout results in Vulnetix

Upload Docker Scout SARIF, CycloneDX, SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Docker Scout documentation ↗

Wire Docker Scout into your CI/CD pipeline →