docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

clarified DTR scanning for Windows images (#5151) 

Signed-off-by: Victoria Bialas <victoria.bialas@docker.com>
This commit is contained in:
Victoria Bialas 2017-10-27 15:13:16 -07:00 committed by GitHub
parent 341fe3c666
commit 3d9ba561b0
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
datacenter/dtr/2.3/guides/user/manage-images/scan-images-for-vulnerabilities.md
View File

@ -27,20 +27,20 @@ Scans run either on demand when a user clicks the **Start a Scan** links or
on any `docker push` to the repository. on any `docker push` to the repository.
First the scanner performs a binary scan on each layer of the image, identifies First the scanner performs a binary scan on each layer of the image, identifies
the software components in each layer, and indexes the SHA of each component in a the software components in each layer, and indexes the SHA of each component in
bill-of-materials. A binary scan evaluates the components on a bit-by-bit level, a bill-of-materials. A binary scan evaluates the components on a bit-by-bit
so vulnerable components are discovered even if they are statically-linked or level, so vulnerable components are discovered even if they are
under a different name. statically-linked or under a different name.
The scan then compares the SHA of each component against the US National The scan then compares the SHA of each component against the US National
Vulnerability Database that is installed on your DTR instance. When Vulnerability Database that is installed on your DTR instance. When
this database is updated, DTR reviews the indexed components for newly this database is updated, DTR reviews the indexed components for newly
discovered vulnerabilities. discovered vulnerabilities.
DTR scans both Linux and Windows images, but by default Docker doesn't push DTR scans both Linux and Windows images, but but by default Docker doesn't push
image layers for Windows images so DTR won't be able to scan them. foreign image layers for Windows images so DTR won't be able to scan them. If
If you want DTR to scan your Windows images, [configure Docker to always push you want DTR to scan your Windows images, [configure Docker to always push image
image layers](pull-and-push-images.md). layers](pull-and-push-images.md), and it will scan the non-foreign layers.
## Security scan on push ## Security scan on push