Docker Scout fails to recognise DHI base image
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start with the docker/scout-action@v1 invocation and its quickview,cves output, then inspect how Scout obtains and interprets the SBOM and provenance attestations for the linked DHI Debian base image. Done means Scout recognises the DHI base image instead of reporting "image has no base image" in the provided pipeline and Docker Hub cases.
Written by the indexing model from the issue text.
Description
Github Actions pipeline run for reference -> https://github.com/unixerius/proxmox-qdevice/actions/runs/21072965388/job/60607307451
The same issue occurs with Scout as integrated into Docker Hub -> https://hub.docker.com/repository/docker/unixerius/proxmox-qdevice/general
The containers that are being built are based off of Docker's DHI (docker hardened image) Debian Base image -> https://hub.docker.com/hardened-images/catalog/dhi/debian-base
The Docker Buildx instructions for my containers include the options for --sbom and --provenance mode=max. Both Buildx and Scout confirm that provenance information is included in the image.
Regardless, Docker Scout fails to recognise the base image.
Logs from the pipeline run:
Run docker/scout-action@v1
with:
command: quickview,cves
image: ghcr.io/***/proxmox-qdevice:bookworm
ignore-unchanged: true
only-severities: critical,high
github-token: ***
summary: true
format: json
write-comment: true
env:
registry: ***
image: proxmox-qdevice
quickview
✓ SBOM obtained from attestation, 135 packages found
✓ Provenance obtained from attestation
Error: image has no base image
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from docker/scout-cli
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
allstar
Difficulty 2/5 1-3 hours Newbie friendliness 45/100
-
Difficulty 4/5 3-5 days Newbie friendliness 48/100
-
panic: nil deref in createVCS() scanning multi-arch image by tag when no attestation sidecar exists Open
Difficulty 4/5 3-5 days Newbie friendliness 64/100
All issues in docker/scout-cli
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
community-scripts/ProxmoxVE#17425 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 90/100
danielmiessler/LifeOS#2218 ·
-
docs(agents): strengthen the no-backslash-escaped-backticks rule with an issue-creation example Open
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
technical-debt
Difficulty 2/5 1-3 hours Newbie friendliness 85/100
ll7/robot_sf_ll7#9560 ·
-
package-update
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
oSoWoSo/vOid_Community_repOsitory#148 · 1 comment ·