Merge pull request #20247 from dvdksn/scout-everywhere-beta

scout: health scores private beta
This commit is contained in:
David Karlsson 2024-06-20 13:16:15 +02:00 committed by GitHub
commit 1ee011cae7
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
5 changed files with 58 additions and 23 deletions

Binary file not shown.

After

Width:  |  Height:  |  Size: 52 KiB

Binary file not shown.

After

Width:  |  Height:  |  Size: 91 KiB

View File

@ -4,14 +4,13 @@ description: |
Docker Scout health scores provide a supply chain assessment for Docker Hub
images, grading them from A to F based on various security policies.
keywords: scout, health scores, evaluation, checks, grades, docker hub
sitemap: false
---
> **Early Access**
> **Beta**
>
> Health scores is an [Early Access](/release-lifecycle/#early-access-ea)
> feature of Docker Scout. The feature is only available to organizations
> participating in the early access program for this feature.
> Health scores is a [Beta](/release-lifecycle/#beta) feature of Docker Scout.
> The feature is only available to organizations selected to participate in the
> early access program.
{ .restricted }
Docker Scout health scores provide a security assessment, and overall supply
@ -25,10 +24,36 @@ have at least “read” access to the repository, can view the health score. Th
score is not visible to users outside the organization or members without
"read" access.
## Viewing health scores
To view the health score of an image:
1. Go to Docker Hub and sign in.
2. Navigate to your organization's page.
In the list of repositories, you can see the health score of each repository
based on the latest pushed tag.
![Repository health score](../images/score-badges-repolist.png)
The health score badge is color-coded to indicate the overall health of the
repository:
- **Green**: A score of A or B.
- **Yellow**: A score of C.
- **Orange**: A score of D.
- **Red**: A score of E or F.
- **Gray**: An `N/A` score.
The score is also displayed on the Docker Hub page for a given repository,
along with each policy that contributed to the score.
![Scout "A" health score](../images/score-a-shiny.png?w=450px)
## Scoring system
Health scores are determined by evaluating images against a set of Docker Scout
[policies](./policy/_index.md). These policies align with best practices for
[policies](./_index.md). These policies align with best practices for
the software supply chain and are recommended by Docker as foundational
standards for images.
@ -59,19 +84,34 @@ total possible points.
| 11% to 30% | E |
| Less than 10% | F |
### N/A scores
Images can also be assigned an `N/A` score, which can happen when:
- The image is larger than 4GB (compressed size).
- The image architecture is not `linux/amd64` or `linux/arm64`.
- The image is too old and does not have fresh data for evaluation.
If you see an `N/A` score, consider the following:
- If the image is too large, try reducing the size of the image.
- If the image has an unsupported architecture, rebuild the image for a
supported architecture.
- If the image is too old, push a new tag to trigger a fresh evaluation.
### Policy weights
The policies that influence the score, and their respective weights, are as follows:
| Policy | Points |
| --------------------------------------------------------------------------------------------------------- | ------ |
| [Fixable Critical and High Vulnerabilities](./policy/_index.md#fixable-critical-and-high-vulnerabilities) | 20 |
| [High-Profile Vulnerabilities](./policy/_index.md#high-profile-vulnerabilities) | 20 |
| [Supply Chain Attestations](./policy/_index.md#supply-chain-attestations) | 15 |
| [Unapproved Base Images](./policy/_index.md#unapproved-base-images) | 15 |
| [Outdated Base Images](./policy/_index.md#outdated-base-images) | 10 |
| [Default Non-Root User](./policy/_index.md#default-non-root-user) | 5 |
| [Copyleft Licenses](./policy/_index.md#copyleft-licenses) | 5 |
| [Fixable Critical and High Vulnerabilities](./_index.md#fixable-critical-and-high-vulnerabilities) | 20 |
| [High-Profile Vulnerabilities](./_index.md#high-profile-vulnerabilities) | 20 |
| [Supply Chain Attestations](./_index.md#supply-chain-attestations) | 15 |
| [Unapproved Base Images](./_index.md#unapproved-base-images) | 15 |
| [Outdated Base Images](./_index.md#outdated-base-images) | 10 |
| [Default Non-Root User](./_index.md#default-non-root-user) | 5 |
| [Copyleft Licenses](./_index.md#copyleft-licenses) | 5 |
### Evaluation
@ -97,21 +137,14 @@ For an image with a total possible score of 90 points:
## Improving your health score
To improve the health score of an image, take steps to ensure that the image is
compliant with the Docker Scout recommended [policies](./policy/_index.md).
compliant with the Docker Scout recommended [policies](./_index.md).
1. Go to the [Docker Scout Dashboard](https://scout.docker.com/).
2. Sign in using your Docker ID.
3. Go to [Repository settings](https://scout.docker.com/settings/repos) and
enable Docker Scout for your Docker Hub image repositories.
4. Analyze the [policy compliance](./policy/_index.md) for your repositories,
4. Analyze the [policy compliance](./_index.md) for your repositories,
and take actions to ensure your images are policy-compliant.
Since policies are weighted differently, prioritize the policies with the
highest scores for a greater impact on your image's overall score.
## Known limitations
Health score can currently only be evaluated for:
- Images with a `linux/amd64` or `linux/arm64` architecture.
- Images up to 4GB in compressed size.

View File

@ -652,7 +652,7 @@
- /go/scout-notifications/
"/scout/integrations/team-collaboration/slack/":
- "/go/scout-slack/"
"/scout/scores/":
"/scout/policy/scores/":
- /go/scout-scores/
# Build links (internal)

View File

@ -1442,6 +1442,8 @@ Manuals:
section:
- path: /scout/policy/
title: Overview
- path: /scout/policy/scores/
title: Health scores {{< badge color=blue text=Beta >}}
- path: /scout/policy/view/
title: View policy status
- path: /scout/policy/configure/