SecurityIntermediate

Docker Scout Cheatsheet

Analyze images for CVEs, generate SBOMs, and enforce supply-chain policy.

What it is

Docker Scout is a supply-chain security tool that scans images for vulnerabilities, produces SBOMs, and lets you set policy gates in CI/CD pipelines.

Bundled with Docker Desktop. Install the standalone CLI with docker scout install or download from the Docker Scout documentation.

docker scout quickview nginx:alpine

Get a fast CVE summary for an image.

docker scout cves nginx:alpine

List all known CVEs in the image.

docker scout sbom nginx:alpine

Generate a Software Bill of Materials (SBOM).

docker scout recommendations nginx:alpine

Get upgrade recommendations to fix vulnerabilities.

Task	Command	Description
Quick CVE summary	`docker scout quickview <image>`	High-level vulnerability overview.
List CVEs	`docker scout cves <image>`	Detailed CVE list with severity.
Generate SBOM	`docker scout sbom <image>`	Full Software Bill of Materials.
Get recommendations	`docker scout recommendations <image>`	Suggests base image upgrades to reduce CVEs.
Compare images	`docker scout compare <img1> --to <img2>`	Diff CVEs between two image versions.
Enroll image	`docker scout enroll <org>`	Enable Scout for an org on Docker Hub.
Push with attestations	`docker buildx build --provenance --sbom -t me/app --push .`	Attach provenance & SBOM at build time.

Flag	Example	Meaning
`--only-severities`	`docker scout cves --only-severities critical,high nginx`	Filter by severity level.
`--format`	`docker scout sbom --format spdx nginx`	Output format (spdx, cyclonedx, etc.).
`--exit-code`	`docker scout cves --exit-code nginx`	Return non-zero exit if CVEs found (CI gating).
`--platform`	`docker scout cves --platform linux/amd64 nginx`	Scan a specific platform variant.

Fail CI if critical CVEs found

docker scout cves --exit-code --only-severities critical my-app:latest

Export SBOM as CycloneDX JSON

docker scout sbom --format cyclonedx my-app:latest > sbom.json

Compare current vs previous release

docker scout compare my-app:v2.0 --to my-app:v1.9

Integrate docker scout cves --exit-code into CI to gate deployments on critical CVEs.
Attach SBOMs at build time with --sbom=true for supply-chain transparency.
Run docker scout recommendations before each release to minimize attack surface.
Use distroless or alpine base images to reduce the number of packages and CVEs.

Scout not found or not enabled

Install or enable the Scout plugin.

docker scout install

Image not indexed

Push the image to Docker Hub to trigger indexing, or use a local image directly.

Last reviewed: 2026-06-15