Connexion
Docker Scout for Vulnerability management of Containers and remediation
I have installed the latest Docker Desktop for Windows version 4.43.2
In today’s cloud-native world, container security is not a luxury—it’s a mission-critical requirement. With the release of Azure Linux 3.0, Microsoft has reinforced its dedication to performance, flexibility, and security. But no matter how polished the host OS is, containers themselves can still be riddled with vulnerabilities, bloated layers, or sneaky outdated dependencies. That’s where Docker Scout and Open Source tool Dive come into play.
Docker Scout: Intelligence at Your Fingertips
Docker Scout introduces vulnerability detection into your CI/CD pipeline. For Azure Linux 3.0 containers, this means:
- Real-Time Vulnerability Scanning: Scout analyzes your container image (including base layers) against CVE databases and flags known vulnerabilities.
- Remediation Guidance: It doesn’t just scream “VULNERABLE!”—Scout offers actionable suggestions like switching to a newer base image or updating specific packages.
- Policy Integration: You can define security policies (e.g., block images with critical CVEs) and automate enforcement in Azure DevOps or GitHub Actions.
In the following steps we will get the Microsoft Azure Linux 3.0 container and scan for security issues before we run the container.
Open Docker terminal
docker pull mcr.microsoft.com/azure-cli:azurelinux3.0
when you have pulled the image, you can do a quick scan with Docker Scout.
docker scout quickview mcr.microsoft.com/azure-cli:azurelinux3.0
docker scout cves mcr.microsoft.com/azure-cli:azurelinux3.0
Here you can see more information about the CVE’s.
Here you see the vulnerable package file and the fix for remediation.
Now we want to remediate this image with the update fix version 2.32.4 of this package. To do this, I made a directory docker fix with a dockerfile (without any extension) with the following commands :
———
# 
Start met Azure CLI base image op Azure Linux 3.0
FROM mcr.microsoft.com/azure-cli:azurelinux3.0
# Install Python and pip via tdnf
RUN tdnf install -y python3 python3-pip
# Upgrade pip and install
RUN python3 -m pip install –no-cache-dir –upgrade –ignore-installed pip \
&& python3 -m pip install –no-cache-dir requests==2.32.4
# Remove old files
RUN rm -f /usr/lib/az/lib/python3.12/site-packages/requests-2.32.3.dist-info/METADATA
# Verify
RUN python3 -c “import requests; print(f’Requests versie: {requests.__version__}’)”
————-
With Open Source tool Dive you can have a look into the Docker image. This supported me because first I did only the install and upgrade of the file requests version 2.32.3 to fixed version 2.32.4. But then Docker Scout still see the vulnerability file in the image.
dive [Image]
So that’s why we remove it via the Dockerfile.
We now building a new image with this dockerfile :
docker buildx build –provenance=true –sbom=true -t azure-cli-patched:latest .
After a Docker Scout scan, there are zero vulnerabilities in the image now
and in the Container fixed version 2.32.4 is running.
Conclusion
Docker Scout represents a major leap forward in managing container security, efficiency, and reliability. By integrating seamlessly into the Docker ecosystem, it empowers developers to ship production-ready containers with confidence.
Key Benefits
- Security Insights: Automatically detects vulnerabilities, recommends fixes, and integrates with CVE databases.
- Dependency Intelligence: Tracks changes and upgrades across your software stack to ensure compatibility and stability.
- Image Comparison: Visualizes differences between builds—helping you pinpoint unintended changes and regressions.
- Team Collaboration: Enables shared visibility across development pipelines, so teams can align on image quality and release standards.
In short, Docker Scout turns container image analysis into a proactive, collaborative part of modern DevOps. Whether you’re optimizing performance or hardening against threats, Scout puts you ahead of the curve.
