Docker scout vulnerabilities

Show only CVEs that already have a fix available

docker scout cves --only-fixed myapp:latest
tool
docker46 commands
tags
dockersecurity

More docker commands

  • Run temporary debug container
    docker run --rm -it --pid=host --network=host --privileged nicolaka/netshoot

    Full-featured network debug container sharing host PID and network

  • Build matrix from bake file
    docker buildx bake -f docker-bake.hcl --push

    Build/push multiple targets from one HCL file; parallel, DRY group definitions

  • Inspect multi-arch manifest
    docker buildx imagetools inspect <reg>/<name>:tag --format '{{json .Manifest}}'

    Show platforms in a manifest list without pulling layers; verify arm64+amd64

  • Container driver builder
    docker buildx create --name multi --use --driver docker-container --driver-opt network=host

    Create a BuildKit builder supporting multi-arch and cache export; default driver cannot

  • Pass build secret from file
    docker buildx build --secret id=token,src=token.txt -t <name> .

    Feed a secret to BuildKit; only RUN --mount=type=secret,id=token sees it, not history

all 46 docker commands