nprasad2077/docker-docs
1
0 Fork 0
mirror of https://github.com/docker/docs.git synced 2026-11-04 18:26:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

dhi: update supported scanners (#25344)

Browse Source 
<!--Delete sections as needed -->

## Description

- Added a new supported scanner.
- Changed list to a table for better scanability.
- Removed paywalled/login-walled third-party scanners from the how-to
since we just point to their docs, and it's getting weird as the list
grows.
- Removed blogs from additional resources rather than adding the Aikido
blog. Blogs were taking the place of release notes, but now we have
quarterly release notes.

## Related issues or tickets

ENGDOCS-3324

## Reviews

<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->

- [ ] Editorial review
- [ ] Product review

---------

Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
This commit is contained in:
Craig Osterhout authored and GitHub committed 2026-06-15 08:29:12 -07:00
1 parent 338ecb5235
commit b4f08ba8de
4 files changed
+20 -107
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

content/manuals/dhi/_index.md
+1 -1
View File
@@ -31,7 +31,7 @@ params:
icon: question-mark-circle
link: /dhi/troubleshoot/
- title: Additional resources
description: Guides, blog posts, Docker Hub catalog, GitHub repositories, and more.
description: Guides, Docker Hub catalog, GitHub repositories, and more.
icon: link
link: /dhi/resources/
- title: Release notes
content/manuals/dhi/explore/scanner-integrations.md
+14 -19
View File
@@ -1,7 +1,7 @@
---
title: Scanner integrations
description: Learn which vulnerability scanners work with Docker Hardened Images and how to choose the right scanner for accurate vulnerability assessment.
keywords: scanner integration, vulnerability scanning, docker scout, trivy, grype, mend.io, black duck, container security scanners
keywords: scanner integration, vulnerability scanning, docker scout, trivy, grype, wiz, black duck, aikido, container security scanners
weight: 40
---
@@ -13,23 +13,19 @@ attestations included with each image.
## Scanners with VEX support
The following scanners can read and apply VEX attestations included with Docker
Hardened Images to deliver more accurate vulnerability assessments:
Hardened Images:
- [Docker Scout](/scout/): Automatically applies VEX statements with
zero configuration. Integrated directly into Docker Desktop and the Docker CLI.
- [Trivy](https://trivy.dev/): Supports VEX through VEX Hub for automatic
updates or local VEX files for air-gapped environments.
- [Grype](https://github.com/anchore/grype): Supports VEX via the `--vex`
flag for local VEX file processing.
- [Wiz](https://www.wiz.io/): Automatically applies VEX statements with
zero configuration.
- [Mend.io](https://www.mend.io/): Automatically retrieves and applies VEX
statements with zero configuration. Combines VEX data with reachability
analysis.
- [Black Duck](https://www.blackduck.com/): Identifies Docker Hardened Images
and applies VEX statements with zero configuration.
| Scanner | VEX application |
|---------|-----------------|
| [Docker Scout](/scout/) | Automatic, zero configuration |
| [Trivy](https://trivy.dev/) | VEX Hub (recommended) or local VEX file |
| [Grype](https://github.com/anchore/grype) | Via `--vex` flag with local VEX file |
| [Wiz](https://docs.wiz.io/) | Automatic, zero configuration |
| [Mend.io](https://docs.mend.io/platform/latest/docker-hardened-images) | Automatic, zero configuration |
| [Black Duck](https://documentation.blackduck.com/bundle/bd-hub/page/Reporting/vexReport_global.html) | Automatic, zero configuration |
| [Aikido](https://help.aikido.dev/container-image-scanning/standalone-registries/docker-hub-images) | Automatic, zero configuration |
For step-by-step instructions, see [Scan Docker Hardened Images](/manuals/dhi/how-to/scan.md).
For step-by-step instructions for Docker Scout, Trivy, and Grype, see [Scan Docker Hardened Images](/manuals/dhi/how-to/scan.md). For Wiz, Mend.io, Black Duck, and Aikido, refer to their respective documentation.
## Choosing a scanner for Docker Hardened Images
@@ -68,8 +64,7 @@ from Docker Hardened Images offer the following benefits:
aren't flagged; security teams and compliance officers can review the reasoning
rather than trusting a vendor's black box.
- Scanner flexibility: Switch between any VEX-enabled scanner (Docker Scout,
Trivy, Grype, Wiz, Mend.io, Black Duck, etc.) without losing vulnerability
context or rebuilding exclusion lists.
Trivy, Grype, etc.) without losing vulnerability context or rebuilding exclusion lists.
- Consistent results: VEX-enabled scanners interpret the same data the
same way, eliminating discrepancies between tools.
- Faster workflows: Focus on real risks rather than researching why reported
@@ -101,7 +96,7 @@ The image includes signed attestations that explain which vulnerabilities don't
apply and why. Any VEX-enabled scanner can read these attestations, giving you:
- Tool flexibility: Use any scanner that supports OpenVEX (Docker Scout,
Trivy, Grype, Wiz, Mend.io, Black Duck, etc.)
Trivy, Grype, etc.)
- Complete transparency: Review the exact reasoning for each vulnerability
assessment
- Full auditability: Security teams and compliance officers can independently
content/manuals/dhi/how-to/scan.md
+3 -62
View File
@@ -1,8 +1,8 @@
---
title: Scan Docker Hardened Images
linktitle: Scan an image
description: Learn how to scan Docker Hardened Images for known vulnerabilities using Docker Scout, Grype, Trivy, Wiz, Mend.io, or Black Duck.
keywords: scan container image, docker scout cves, grype scanner, trivy container scanner, mend.io, black duck, vex attestation
description: Learn how to scan Docker Hardened Images for known vulnerabilities using Docker Scout, Grype, or Trivy.
keywords: scan container image, docker scout cves, grype scanner, trivy container scanner, vex attestation
weight: 46
---
@@ -19,16 +19,8 @@ read and apply the VEX statements included with Docker Hardened Images:
- [Docker Scout](#docker-scout): Automatically applies VEX statements with zero configuration
- [Trivy](#trivy): Supports VEX through VEX Hub or local VEX files
- [Grype](#grype): Supports VEX via the `--vex` flag
- [Wiz](#wiz): Automatically applies VEX statements with
zero configuration
- [Mend.io](#mendio): Automatically applies VEX statements with
zero configuration
- [Black Duck](#black-duck): Automatically applies VEX statements with
zero configuration
For guidance on choosing the right scanner and understanding the differences
between VEX-enabled and non-VEX scanners, see [Scanner
integrations](/manuals/dhi/explore/scanner-integrations.md).
For a full list of supported scanners, see [Scanner integrations](/manuals/dhi/explore/scanner-integrations.md).
## Docker Scout
@@ -360,57 +352,6 @@ Then scan the image with the local VEX file:
$ trivy image --scanners vuln --vex vex.json dhi.io/<image>:<tag>
```
## Wiz
[Wiz](https://www.wiz.io/) is a cloud security platform that includes container
image scanning capabilities with support for DHI VEX attestations. Wiz CLI
automatically consumes VEX statements from Docker Hardened Images to provide
accurate vulnerability assessments.
### Scan a DHI using Wiz CLI
After acquiring a Wiz subscription and installing the Wiz CLI, you can scan a
Docker Hardened Image by pulling the image and running the scan command:
```console
$ docker login dhi.io
$ docker pull dhi.io/<image>:<tag>
$ wizcli scan container-image dhi.io/<image>:<tag>
```
## Mend.io
[Mend.io](https://www.mend.io/) is an application security platform that
includes container image scanning with support for DHI VEX attestations.
Mend Container automatically retrieves and applies VEX statements from Docker
Hardened Images and combines them with Mend's reachability analysis for
comprehensive vulnerability assessment.
### Scan a DHI using Mend.io
After acquiring a Mend.io subscription and configuring
[Mend Container](https://docs.mend.io/container/latest/), Mend automatically
detects Docker Hardened Images and applies their VEX data without requiring any
additional configuration. When you scan a Docker Hardened Image through the Mend
AppSec Platform, VEX statements are automatically retrieved and attached as risk
factors to each finding.
You can view and filter DHI-specific findings in the Mend AppSec Platform under
**Security > Containers > Packages**, where a Docker badge identifies hardened
image packages. Use the **Risk Factors** column to filter by VEX statuses such
as Not Affected, Fixed, or Under Investigation.
For more information, see the [Mend.io Docker Hardened Images
documentation](https://docs.mend.io/platform/latest/docker-hardened-images).
## Black Duck
[Black Duck](https://www.blackduck.com/) identifies Docker Hardened Images and
applies their VEX statements without additional configuration.
For more information, see the [Black Duck
documentation](https://documentation.blackduck.com/bundle/bd-hub/page/Reporting/vexReport_global.html).
## Export VEX attestations
For scanners that need local VEX files (like Grype or Trivy with local files),
content/manuals/dhi/resources.md
+2 -25
View File
@@ -1,39 +1,16 @@
---
title: Docker Hardened Images resources
linktitle: Additional resources
description: Additional resources including product information, blog posts, and GitHub repositories for Docker Hardened Images
description: Additional resources including product information, guides, and GitHub repositories for Docker Hardened Images
weight: 999
---
This page provides links to additional resources related to Docker Hardened
Images (DHI), including blog posts, guides, Docker Hub resources, and GitHub
repositories.
Images (DHI), including guides, Docker Hub resources, and GitHub repositories.
For product information and feature comparison, visit the [Docker Hardened
Images product page](https://www.docker.com/products/hardened-images/).
## Blog posts
The following blog posts provide insights into Docker Hardened Images, security
features, and announcements:
| Date published | Title |
|------|-------|
| May 5, 2026 | [Precision Container Security with Docker and Black Duck](https://www.docker.com/blog/precision-container-security-with-docker-and-black-duck/) |
| April 14, 2026 | [Why We Chose the Harder Path: Docker Hardened Images, One Year Later](https://www.docker.com/blog/why-we-chose-the-harder-path-docker-hardened-images-one-year-later/) |
| April 8, 2026 | [Reclaim Developer Hours through Smarter Vulnerability Prioritization with Docker and Mend.io](https://www.docker.com/blog/reclaim-developer-hours-through-smarter-vulnerability-prioritization-with-docker-and-mend-io/) |
| March 3, 2026 | [Announcing Docker Hardened System Packages](https://www.docker.com/blog/announcing-docker-hardened-system-packages/) |
| January 25, 2026 | [Making the Most of Your Docker Hardened Images Enterprise Trial - Part 3](https://www.docker.com/blog/making-the-most-of-your-docker-hardened-images-enterprise-trial-part-3/) |
| January 24, 2026 | [Making the Most of Your Docker Hardened Images Enterprise Trial - Part 2](https://www.docker.com/blog/making-the-most-of-your-docker-hardened-images-enterprise-trial-part-2/) |
| December 19, 2025 | [Docker Hardened Images: Security Independently Validated by SRLabs](https://www.docker.com/blog/docker-hardened-images-security-independently-validated-by-srlabs/) |
| December 17, 2025 | [A Safer Container Ecosystem with Docker: Free Docker Hardened Images](https://www.docker.com/blog/docker-hardened-images-for-every-developer/) |
| November 14, 2025 | [Making the Most of Your Docker Hardened Images Enterprise Trial - Part 1](https://www.docker.com/blog/making-the-most-of-your-docker-hardened-images-trial-part-1/) |
| October 15, 2025 | [Docker Hardened Images: Crafted by Humans, Protected by AI](https://www.docker.com/blog/docker-hardened-images-crafted-by-humans-protected-by-ai/) |
| September 29, 2025 | [Expanding Docker Hardened Images: Secure Helm Charts for Deployments](https://www.docker.com/blog/docker-hardened-images-helm-charts-beta/) |
| August 6, 2025 | [The Next Evolution of Docker Hardened Images: Customizable, FedRAMP Ready, AI Migration Agent, and Deeper Integrations](https://www.docker.com/blog/the-next-evolution-of-docker-hardened-images/) |
| August 6, 2025 | [Accelerating FedRAMP Compliance with Docker Hardened Images](https://www.docker.com/blog/fedramp-compliance-with-hardened-images/) |
| May 19, 2025 | [Introducing Docker Hardened Images: Secure, Minimal, and Ready for Production](https://www.docker.com/blog/introducing-docker-hardened-images/) |
## Guides
For guides that demonstrate how to use Docker Hardened Images in various