Docker Scout

docker scout cves <image>

Scans the image with Docker Scout, detecting CVEs with the native integration of the Docker ecosystem.

Run it in the pipeline (or locally) when you want the analysis of the images with Docker's native tool: docker scout cves analyzes the image and reports the findings — the CVEs with severity, the fix, and the image base (the version). It's the scanner integrated into the Docker ecosystem (Docker Desktop and Hub): the analysis of the images with the same tool as the build. In DevSecOps with Docker, Scout is the pipeline piece: the build with high-severity findings gets blocked (with the policy gate).

Don't use it without Docker: scout is the extension of the Docker ecosystem (requires Docker Desktop/Hub or the CLI with an account) — outside the ecosystem, Trivy/Grype are independent. Scout's base updates: new CVEs require the update. And watch out: findings are triaged; the --only-fixed filters. For the pipeline without Docker, Trivy (029) or Grype (030); Scout is the ecosystem option.