diff --git a/content/scout/images/score-a-shiny.png b/content/scout/images/score-a-shiny.png new file mode 100644 index 0000000000..5db0254ecf Binary files /dev/null and b/content/scout/images/score-a-shiny.png differ diff --git a/content/scout/images/score-badges-repolist.png b/content/scout/images/score-badges-repolist.png new file mode 100644 index 0000000000..dcfb016bbb Binary files /dev/null and b/content/scout/images/score-badges-repolist.png differ diff --git a/content/scout/scores.md b/content/scout/policy/scores.md similarity index 60% rename from content/scout/scores.md rename to content/scout/policy/scores.md index d79f493094..6e60aa32b6 100644 --- a/content/scout/scores.md +++ b/content/scout/policy/scores.md @@ -4,14 +4,13 @@ description: | Docker Scout health scores provide a supply chain assessment for Docker Hub images, grading them from A to F based on various security policies. keywords: scout, health scores, evaluation, checks, grades, docker hub -sitemap: false --- -> **Early Access** +> **Beta** > -> Health scores is an [Early Access](/release-lifecycle/#early-access-ea) -> feature of Docker Scout. The feature is only available to organizations -> participating in the early access program for this feature. +> Health scores is a [Beta](/release-lifecycle/#beta) feature of Docker Scout. +> The feature is only available to organizations selected to participate in the +> early access program. { .restricted } Docker Scout health scores provide a security assessment, and overall supply @@ -25,10 +24,36 @@ have at least “read” access to the repository, can view the health score. Th score is not visible to users outside the organization or members without "read" access. +## Viewing health scores + +To view the health score of an image: + +1. Go to Docker Hub and sign in. +2. Navigate to your organization's page. + +In the list of repositories, you can see the health score of each repository +based on the latest pushed tag. + +![Repository health score](../images/score-badges-repolist.png) + +The health score badge is color-coded to indicate the overall health of the +repository: + +- **Green**: A score of A or B. +- **Yellow**: A score of C. +- **Orange**: A score of D. +- **Red**: A score of E or F. +- **Gray**: An `N/A` score. + +The score is also displayed on the Docker Hub page for a given repository, +along with each policy that contributed to the score. + +![Scout "A" health score](../images/score-a-shiny.png?w=450px) + ## Scoring system Health scores are determined by evaluating images against a set of Docker Scout -[policies](./policy/_index.md). These policies align with best practices for +[policies](./_index.md). These policies align with best practices for the software supply chain and are recommended by Docker as foundational standards for images. @@ -59,19 +84,34 @@ total possible points. | 11% to 30% | E | | Less than 10% | F | +### N/A scores + +Images can also be assigned an `N/A` score, which can happen when: + +- The image is larger than 4GB (compressed size). +- The image architecture is not `linux/amd64` or `linux/arm64`. +- The image is too old and does not have fresh data for evaluation. + +If you see an `N/A` score, consider the following: + +- If the image is too large, try reducing the size of the image. +- If the image has an unsupported architecture, rebuild the image for a + supported architecture. +- If the image is too old, push a new tag to trigger a fresh evaluation. + ### Policy weights The policies that influence the score, and their respective weights, are as follows: | Policy | Points | | --------------------------------------------------------------------------------------------------------- | ------ | -| [Fixable Critical and High Vulnerabilities](./policy/_index.md#fixable-critical-and-high-vulnerabilities) | 20 | -| [High-Profile Vulnerabilities](./policy/_index.md#high-profile-vulnerabilities) | 20 | -| [Supply Chain Attestations](./policy/_index.md#supply-chain-attestations) | 15 | -| [Unapproved Base Images](./policy/_index.md#unapproved-base-images) | 15 | -| [Outdated Base Images](./policy/_index.md#outdated-base-images) | 10 | -| [Default Non-Root User](./policy/_index.md#default-non-root-user) | 5 | -| [Copyleft Licenses](./policy/_index.md#copyleft-licenses) | 5 | +| [Fixable Critical and High Vulnerabilities](./_index.md#fixable-critical-and-high-vulnerabilities) | 20 | +| [High-Profile Vulnerabilities](./_index.md#high-profile-vulnerabilities) | 20 | +| [Supply Chain Attestations](./_index.md#supply-chain-attestations) | 15 | +| [Unapproved Base Images](./_index.md#unapproved-base-images) | 15 | +| [Outdated Base Images](./_index.md#outdated-base-images) | 10 | +| [Default Non-Root User](./_index.md#default-non-root-user) | 5 | +| [Copyleft Licenses](./_index.md#copyleft-licenses) | 5 | ### Evaluation @@ -97,21 +137,14 @@ For an image with a total possible score of 90 points: ## Improving your health score To improve the health score of an image, take steps to ensure that the image is -compliant with the Docker Scout recommended [policies](./policy/_index.md). +compliant with the Docker Scout recommended [policies](./_index.md). 1. Go to the [Docker Scout Dashboard](https://scout.docker.com/). 2. Sign in using your Docker ID. 3. Go to [Repository settings](https://scout.docker.com/settings/repos) and enable Docker Scout for your Docker Hub image repositories. -4. Analyze the [policy compliance](./policy/_index.md) for your repositories, +4. Analyze the [policy compliance](./_index.md) for your repositories, and take actions to ensure your images are policy-compliant. Since policies are weighted differently, prioritize the policies with the highest scores for a greater impact on your image's overall score. - -## Known limitations - -Health score can currently only be evaluated for: - -- Images with a `linux/amd64` or `linux/arm64` architecture. -- Images up to 4GB in compressed size. diff --git a/data/redirects.yml b/data/redirects.yml index a43a48ab02..8caa7892dd 100644 --- a/data/redirects.yml +++ b/data/redirects.yml @@ -652,7 +652,7 @@ - /go/scout-notifications/ "/scout/integrations/team-collaboration/slack/": - "/go/scout-slack/" -"/scout/scores/": +"/scout/policy/scores/": - /go/scout-scores/ # Build links (internal) diff --git a/data/toc.yaml b/data/toc.yaml index e867f5060d..fc5578f023 100644 --- a/data/toc.yaml +++ b/data/toc.yaml @@ -1442,6 +1442,8 @@ Manuals: section: - path: /scout/policy/ title: Overview + - path: /scout/policy/scores/ + title: Health scores {{< badge color=blue text=Beta >}} - path: /scout/policy/view/ title: View policy status - path: /scout/policy/configure/