docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove stale info on official image scanning 

Signed-off-by: Usha Mandya <usha.mandya@docker.com>
This commit is contained in:
Usha Mandya 2020-10-15 21:50:17 +01:00
parent 0d28c3cb14
commit fedb474255
2 changed files with 1 additions and 107 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
docker-hub/official_images.md
View File

@ -60,36 +60,6 @@ insufficient, it is still recommended to inherit from an Official Image
base OS image to leverage the ongoing maintenance work, rather than duplicating
these efforts.
## Official Image Vulnerability Scanning
Each of the images in the Official Images is scanned for vulnerabilities. The
results of these security scans provide valuable information about which images
contain security vulnerabilities, and allow you to choose images that align with
your security standards.
To view the Docker Security Scanning results:
1. Make sure you're logged in to Docker Hub. You can view Official Images even
while logged out, however the scan results are only available once you log
in.
2. Navigate to the repository of the Official Image whose security scan you want
to view.
3. Click the `Tags` tab to see a list of tags. and their security scan summaries.
![Official Image Tags](images/official_images-tags-home.png)
4. Click on a tag to see the image's security scan summary.
![Official Image Tags](images/official_images-tags-2019.png)
You can click into a tag's detail page to see more information about which
layers in the image and which components within the layer are vulnerable.
Details including a link to the official CVE report for the vulnerability appear
when you click an individual vulnerable component.
## Submitting Feedback for Official Images
All Official Images contain a **User Feedback** section in their

78
docker-hub/publish/publish.md
View File

@ -22,7 +22,6 @@ is not supported by Docker nor is it eligible to become Certified.
| If your content: | Can publish | Can be Certified | Supported by publisher |
|:-----|:--------|:------|:-----|
| Works on Docker Enterprise | YES | YES | Required |
| Works on Docker Community | YES | NO | Optional |
| Does not work on Docker Certified Infrastructure | NO | N/A | N/A |
@ -185,85 +184,10 @@ response-time expectations, where applicable.
## Security and audit policies
Docker Hub [scans](#docker-security-scanning) your content for
vulnerabilities with the Docker Security Scanning tool, and
Docker Hub
[audits](#usage-audit-and-reporting) consumer activity of your images to provide
you intelligence about the use of your product.
### Docker Security Scanning
Docker Security Scanning automatically and continuously assesses the integrity
of your products. The Docker Security Scanning tool deconstructs an image,
conducts a binary scan of the bits to identify the open-source components
present in each image layer, and associates those components with known
vulnerabilities and exposures.
Docker then shares the scan results with you as the publisher, so that you can
modify the content of your images as necessary. Your scan results are private,
and are never shared with end customers or other publishers.
#### Interpret results
To interpret the results of a scanned image:
1. Log on to [Docker Hub](https://hub.docker.com){: target="_blank" rel="noopener" class="_"}.
2. Navigate to the repository details page (for example,
[nodejs](https://hub.docker.com/_/nodejs){: target="_blank" rel="noopener" class="_"}).
3. Click **Tags**.
![Scanned tags](images/image-tags.png)
In this section, you can now view the different architectures separately to
easily identify the right image for the architecture you need, complete
with image size and operating system information.
![system info](images/node-tags-system-info.png)
4. Click on the digest for a particular architecture. You can now also see the
actual source of the image: the layer-by-layer details that make up the image.
![system info](images/node-tags-vulnerabilities.png)
5. Click on any row in the **Image History** list. You’ll see that the image contains multiple components, and that some of them have known vulnerabilities ranging from minor to critical. To explore further, click on the caret to expand and view all of the found vulnerabilities:
![Scanned components](images/node-tags-vulnerability-details.png)
Each vulnerability is linked directly to the CVE (Common Vulnerabilities and Exposures) list entry so that you can learn more about the CVE entry and its implications.
#### Classification of issues
* All Scan results include the CVE numbers and a CVSS (Common Vulnerability
Scoring System) Score.
* CVE Identifiers (also referred to by the community as "CVE names," "CVE
numbers," "CVE entries," "CVE-IDs," and "CVEs") are unique identifiers for
publicly-known, cyber-security vulnerabilities.
* The Common Vulnerability Scoring System (CVSS) provides an open
framework for communicating the characteristics and impacts of
IT vulnerabilities. Its quantitative model ensures repeatable,
accurate measurement while enabling users to see the underlying
vulnerability characteristics that were used to generate the scores.
As a result, CVSS is well-suited as a standard measurement system
for industries, organizations, and governments that need accurate
and consistent vulnerability-impact scores. CVSS is commonly used
to prioritize vulnerability-remediation activities, and calculate
the severity of vulnerabilities discovered on systems. The
National Vulnerability Database (NVD) provides CVSS scores for
almost all known vulnerabilities.
* In addition to CVSS, the Docker Security team can identify or classify
vulnerabilities that need to be fixed, and categorize them in the
minor-to-critical range.
* The publisher is presented with initial scan results, including all components
with their CVEs and their CVSS scores.
* If you use Docker’s Scanning Service, you can subscribe to a notification
service for new vulnerabilities.
### Usage audit and reporting
Unless otherwise negotiated, an audit of activity on publisher content is