Docker Scout vs Scan
Tags: docker, devops, productivity, discuss
Published: 2023-04-06 08:39:55

Vulnerability scanning for local Docker images was introduced in late 2020 with the command `docker scan`. The Docker Scan command would use Snyk's engine to scan Docker images for security vulnerabilities and create a list of Common Vulnerabilities and Exposures (CVEs).

Around a month ago, Docker introduced their own security scanning command, `docker scout`, deprecating `docker scan`. After the SBOM hype of late and the introduction of the Docker command `docker sbom` a few months back, it was a more achievable goal for Docker to develop their own security solution based on the already available toolchain.

This piece would briefly introduce and compare the two Docker subcommands.

## Command Interface

Both the Scan and Scout commands, when introduced, came bundled into Docker Desktop. Installation of a CLI extension was required for non-Desktop users (e.g. people running the Docker engine natively on Linux).

I’m running Docker Desktop 4.17.0 on Mac (M2 processor). Let’s try to see the Docker Scan version:

```bash
docker scan --version
```

Here is the output:

```
  │ The  docker scan  command is deprecated and will no longer be supported after April 13th, 2023.
  │ Run the  docker scout cves  command to continue to get vulnerabilities on your images or install the Snyk CLI.
  │ See https://www.docker.com/products/docker-scout for more details.


the Snyk version 1.1056.0 installed on your system is older as the one embedded by Docker Desktop (>=1.1064.0), using embedded Snyk version instead

Version:    v0.25.0
Git commit: 284fb08
Provider:   Snyk (1.1064.0)
```

In around a week, Docker will stop supporting Docker Scan, and users who still want to use Snyk for scanning their Docker images should install Snyk's CLI directly.

Now let’s try checking Docker Scout’s version:

```bash
docker scout version
```

```
version: v0.6.0 (go1.19.5 - darwin/arm64)
git commit: aabe2bfd192f7ac8cbfa4afea647b4dc41d3d30d
```

To scan an image with Docker Scan, one should’ve used the following command:

```bash
docker scan <image>
```

With Docker Scout, the following command interface is used:

```bash
docker scout cves <image>
```

As of Docker Desktop 4.17, `version` and `cves` were the only two subcommands available for `docker scout`, but this interface design hinted at having more subcommands in the future. This happened with Docker Desktop 4.18 that was published yesterday, and a few more commands where added:

```bash
docker scout --help
```

```
Usage:  docker scout COMMAND

Command line tool for Docker Scout

Commands:
  compare         [early preview] Compare two images and display differences
  cves            Display CVEs identified in a software artifact
  quickview       Quick overview of an image
  recommendations Display available base image updates and remediation recommendations
  version         Show Docker Scout version information

Run 'docker scout COMMAND --help' for more information on a command.
```

To learn more about these commands, please refer to the following article:

- [10 Docker Command You Didn't Know About](https://aerabi.medium.com/10-docker-commands-you-didnt-know-about-2b115537597a)

## Comparison of Results

To see how different the formatting of the results of the two commands is, let's scan the same image with both: `aerabi/git-weekly` which is the Docker image that contains my Git Weekly Docker Desktop Extension. I have compared the CVEs in the base image, so the printed output is a part of the original output the commands would give.

```bash
docker scan aerabi/git-weekly
```

```
✗ Medium severity vulnerability found in openssl/libcrypto1.1
  Description: CVE-2022-4304
  Info: https://security.snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314623
  Introduced through: openssl/libcrypto1.1@1.1.1q-r0, openssl/libssl1.1@1.1.1q-r0, apk-tools/apk-tools@2.12.9-r3, busybox/ssl_client@1.35.0-r17
  From: openssl/libcrypto1.1@1.1.1q-r0
  From: openssl/libssl1.1@1.1.1q-r0 > openssl/libcrypto1.1@1.1.1q-r0
  From: apk-tools/apk-tools@2.12.9-r3 > openssl/libcrypto1.1@1.1.1q-r0
  and 4 more...
  Fixed in: 1.1.1t-r0

✗ High severity vulnerability found in openssl/libcrypto1.1
  Description: Double Free
  Info: https://security.snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314624
  Introduced through: openssl/libcrypto1.1@1.1.1q-r0, openssl/libssl1.1@1.1.1q-r0, apk-tools/apk-tools@2.12.9-r3, busybox/ssl_client@1.35.0-r17
  From: openssl/libcrypto1.1@1.1.1q-r0
  From: openssl/libssl1.1@1.1.1q-r0 > openssl/libcrypto1.1@1.1.1q-r0
  From: apk-tools/apk-tools@2.12.9-r3 > openssl/libcrypto1.1@1.1.1q-r0
  and 4 more...
  Fixed in: 1.1.1t-r0

✗ High severity vulnerability found in openssl/libcrypto1.1
  Description: Access of Resource Using Incompatible Type ('Type Confusion')
  Info: https://security.snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314641
  Introduced through: openssl/libcrypto1.1@1.1.1q-r0, openssl/libssl1.1@1.1.1q-r0, apk-tools/apk-tools@2.12.9-r3, busybox/ssl_client@1.35.0-r17
  From: openssl/libcrypto1.1@1.1.1q-r0
  From: openssl/libssl1.1@1.1.1q-r0 > openssl/libcrypto1.1@1.1.1q-r0
  From: apk-tools/apk-tools@2.12.9-r3 > openssl/libcrypto1.1@1.1.1q-r0
  and 4 more...
  Fixed in: 1.1.1t-r0

✗ High severity vulnerability found in openssl/libcrypto1.1
  Description: Use After Free
  Info: https://security.snyk.io/vuln/SNYK-ALPINE316-OPENSSL-3314643
  Introduced through: openssl/libcrypto1.1@1.1.1q-r0, openssl/libssl1.1@1.1.1q-r0, apk-tools/apk-tools@2.12.9-r3, busybox/ssl_client@1.35.0-r17
  From: openssl/libcrypto1.1@1.1.1q-r0
  From: openssl/libssl1.1@1.1.1q-r0 > openssl/libcrypto1.1@1.1.1q-r0
  From: apk-tools/apk-tools@2.12.9-r3 > openssl/libcrypto1.1@1.1.1q-r0
  and 4 more...
  Fixed in: 1.1.1t-r0
```

The Docker Scan report says the Alpine package `openssl/libcrypto1.1` has 4 issues, 3 with high severity and 1 medium, and all are fixed in version `1.1.1t-r0`.

```bash
docker scout cves aerabi/git-weekly
```

```
Analyzing image aerabi/git-weekly
    ✓ SBOM of image already cached, 31 packages indexed
    ✗ Detected 5 vulnerable packages with a total of 19 vulnerabilities

0C    1H    3M    0L  openssl 1.1.1q-r0
pkg:alpine/openssl@1.1.1q-r0?os_name=alpine&os_version=3.16

    ✗ MEDIUM CVE-2022-4450 [Double Free]
      https://dso.docker.com/cve/CVE-2022-4450
      Affected range : <1.1.1t-r0
      Fixed version  : 1.1.1t-r0
      CVSS Score     : 7.5
      CVSS Vector    : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    ✗ MEDIUM CVE-2023-0215 [Use After Free]
      https://dso.docker.com/cve/CVE-2023-0215
      Affected range : <1.1.1t-r0
      Fixed version  : 1.1.1t-r0
      CVSS Score     : 7.5
      CVSS Vector    : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

    ✗ HIGH CVE-2023-0286 [Access of Resource Using Incompatible Type ('Type Confusion')]
      https://dso.docker.com/cve/CVE-2023-0286
      Affected range : <1.1.1t-r0
      Fixed version  : 1.1.1t-r0
      CVSS Score     : 7.4
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

    ✗ MEDIUM CVE-2022-4304
      https://dso.docker.com/cve/CVE-2022-4304
      Affected range : <1.1.1t-r0
      Fixed version  : 1.1.1t-r0
      CVSS Score     : 5.9
      CVSS Vector    : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
```

In the Docker Scout report, the package is listed as `pkg:alpine/openssl` and 4 CVEs are listed, of which 1 has high severity and 3 are medium. Similarly, they are all fixed in the version `1.1.1t-r0`.

Both commands also reported CVEs for Go packages, that are not included in the comparison here.

## SARIF Output

SARIF, the Static Analysis Results Interchange Format, is a standard, JSON-based format for the output of static analysis tools. In [this article](https://itnext.io/docker-image-scan-github-action-27b2ea322740), we used the SARIF output of a Docker image scan to show the vulnerabilities in a GitHub pull request.

With Docker Scout, one can specify SARIF output:

```bash
docker scout cves aerabi/git-weekly \
    --format sarif \
    --output git-weekly.sarif.json
```

Snyk's support for SARIF outputs didn't end up in the Docker Scan command though. To export a SARIF file with Snyk's engine, one should use Snyk's CLI directly.

The Docker Scan command does include a `--json` flag that would output the CVEs in JSON format, but it’s not SARIF-compatible.

## Licensing

As documented in Docker Scout's introduction article, it is only available for paid Docker subscriptions. Docker Scan uses one's Snyk account and hence Snyk's subscription model; it's also available for Snyk's free plan which allows one to perform 100 scans a month.

## Final Words

Docker Scout is still an early-access product and will most likely have rapid changes in the short future.

This article was originally published on my Medium blog: [aerabi.medium.com](https://aerabi.medium.com/). This version is slightly different, as I have updated it with the latest Docker Desktop version that was published yesterday.