diff --git a/content/manuals/dhi/_index.md b/content/manuals/dhi/_index.md index 56fa786308a..274c2e2e71c 100644 --- a/content/manuals/dhi/_index.md +++ b/content/manuals/dhi/_index.md @@ -31,7 +31,7 @@ params: icon: question-mark-circle link: /dhi/troubleshoot/ - title: Additional resources - description: Guides, blog posts, Docker Hub catalog, GitHub repositories, and more. + description: Guides, Docker Hub catalog, GitHub repositories, and more. icon: link link: /dhi/resources/ - title: Release notes diff --git a/content/manuals/dhi/explore/scanner-integrations.md b/content/manuals/dhi/explore/scanner-integrations.md index 0992c50aa64..b3393eaf798 100644 --- a/content/manuals/dhi/explore/scanner-integrations.md +++ b/content/manuals/dhi/explore/scanner-integrations.md @@ -1,7 +1,7 @@ --- title: Scanner integrations description: Learn which vulnerability scanners work with Docker Hardened Images and how to choose the right scanner for accurate vulnerability assessment. -keywords: scanner integration, vulnerability scanning, docker scout, trivy, grype, mend.io, black duck, container security scanners +keywords: scanner integration, vulnerability scanning, docker scout, trivy, grype, wiz, black duck, aikido, container security scanners weight: 40 --- @@ -13,23 +13,19 @@ attestations included with each image. ## Scanners with VEX support The following scanners can read and apply VEX attestations included with Docker -Hardened Images to deliver more accurate vulnerability assessments: - -- [Docker Scout](/scout/): Automatically applies VEX statements with - zero configuration. Integrated directly into Docker Desktop and the Docker CLI. -- [Trivy](https://trivy.dev/): Supports VEX through VEX Hub for automatic - updates or local VEX files for air-gapped environments. -- [Grype](https://github.com/anchore/grype): Supports VEX via the `--vex` - flag for local VEX file processing. -- [Wiz](https://www.wiz.io/): Automatically applies VEX statements with - zero configuration. -- [Mend.io](https://www.mend.io/): Automatically retrieves and applies VEX - statements with zero configuration. Combines VEX data with reachability - analysis. -- [Black Duck](https://www.blackduck.com/): Identifies Docker Hardened Images - and applies VEX statements with zero configuration. - -For step-by-step instructions, see [Scan Docker Hardened Images](/manuals/dhi/how-to/scan.md). +Hardened Images: + +| Scanner | VEX application | +|---------|-----------------| +| [Docker Scout](/scout/) | Automatic, zero configuration | +| [Trivy](https://trivy.dev/) | VEX Hub (recommended) or local VEX file | +| [Grype](https://github.com/anchore/grype) | Via `--vex` flag with local VEX file | +| [Wiz](https://docs.wiz.io/) | Automatic, zero configuration | +| [Mend.io](https://docs.mend.io/platform/latest/docker-hardened-images) | Automatic, zero configuration | +| [Black Duck](https://documentation.blackduck.com/bundle/bd-hub/page/Reporting/vexReport_global.html) | Automatic, zero configuration | +| [Aikido](https://help.aikido.dev/container-image-scanning/standalone-registries/docker-hub-images) | Automatic, zero configuration | + +For step-by-step instructions for Docker Scout, Trivy, and Grype, see [Scan Docker Hardened Images](/manuals/dhi/how-to/scan.md). For Wiz, Mend.io, Black Duck, and Aikido, refer to their respective documentation. ## Choosing a scanner for Docker Hardened Images @@ -68,8 +64,7 @@ from Docker Hardened Images offer the following benefits: aren't flagged; security teams and compliance officers can review the reasoning rather than trusting a vendor's black box. - Scanner flexibility: Switch between any VEX-enabled scanner (Docker Scout, - Trivy, Grype, Wiz, Mend.io, Black Duck, etc.) without losing vulnerability - context or rebuilding exclusion lists. + Trivy, Grype, etc.) without losing vulnerability context or rebuilding exclusion lists. - Consistent results: VEX-enabled scanners interpret the same data the same way, eliminating discrepancies between tools. - Faster workflows: Focus on real risks rather than researching why reported @@ -101,7 +96,7 @@ The image includes signed attestations that explain which vulnerabilities don't apply and why. Any VEX-enabled scanner can read these attestations, giving you: - Tool flexibility: Use any scanner that supports OpenVEX (Docker Scout, - Trivy, Grype, Wiz, Mend.io, Black Duck, etc.) + Trivy, Grype, etc.) - Complete transparency: Review the exact reasoning for each vulnerability assessment - Full auditability: Security teams and compliance officers can independently diff --git a/content/manuals/dhi/how-to/scan.md b/content/manuals/dhi/how-to/scan.md index 81d602e35e9..3f18a5e00d4 100644 --- a/content/manuals/dhi/how-to/scan.md +++ b/content/manuals/dhi/how-to/scan.md @@ -1,8 +1,8 @@ --- title: Scan Docker Hardened Images linktitle: Scan an image -description: Learn how to scan Docker Hardened Images for known vulnerabilities using Docker Scout, Grype, Trivy, Wiz, Mend.io, or Black Duck. -keywords: scan container image, docker scout cves, grype scanner, trivy container scanner, mend.io, black duck, vex attestation +description: Learn how to scan Docker Hardened Images for known vulnerabilities using Docker Scout, Grype, or Trivy. +keywords: scan container image, docker scout cves, grype scanner, trivy container scanner, vex attestation weight: 46 --- @@ -19,16 +19,8 @@ read and apply the VEX statements included with Docker Hardened Images: - [Docker Scout](#docker-scout): Automatically applies VEX statements with zero configuration - [Trivy](#trivy): Supports VEX through VEX Hub or local VEX files - [Grype](#grype): Supports VEX via the `--vex` flag -- [Wiz](#wiz): Automatically applies VEX statements with - zero configuration -- [Mend.io](#mendio): Automatically applies VEX statements with - zero configuration -- [Black Duck](#black-duck): Automatically applies VEX statements with - zero configuration -For guidance on choosing the right scanner and understanding the differences -between VEX-enabled and non-VEX scanners, see [Scanner -integrations](/manuals/dhi/explore/scanner-integrations.md). +For a full list of supported scanners, see [Scanner integrations](/manuals/dhi/explore/scanner-integrations.md). ## Docker Scout @@ -360,57 +352,6 @@ Then scan the image with the local VEX file: $ trivy image --scanners vuln --vex vex.json dhi.io/: ``` -## Wiz - -[Wiz](https://www.wiz.io/) is a cloud security platform that includes container -image scanning capabilities with support for DHI VEX attestations. Wiz CLI -automatically consumes VEX statements from Docker Hardened Images to provide -accurate vulnerability assessments. - -### Scan a DHI using Wiz CLI - -After acquiring a Wiz subscription and installing the Wiz CLI, you can scan a -Docker Hardened Image by pulling the image and running the scan command: - -```console -$ docker login dhi.io -$ docker pull dhi.io/: -$ wizcli scan container-image dhi.io/: -``` - -## Mend.io - -[Mend.io](https://www.mend.io/) is an application security platform that -includes container image scanning with support for DHI VEX attestations. -Mend Container automatically retrieves and applies VEX statements from Docker -Hardened Images and combines them with Mend's reachability analysis for -comprehensive vulnerability assessment. - -### Scan a DHI using Mend.io - -After acquiring a Mend.io subscription and configuring -[Mend Container](https://docs.mend.io/container/latest/), Mend automatically -detects Docker Hardened Images and applies their VEX data without requiring any -additional configuration. When you scan a Docker Hardened Image through the Mend -AppSec Platform, VEX statements are automatically retrieved and attached as risk -factors to each finding. - -You can view and filter DHI-specific findings in the Mend AppSec Platform under -**Security > Containers > Packages**, where a Docker badge identifies hardened -image packages. Use the **Risk Factors** column to filter by VEX statuses such -as Not Affected, Fixed, or Under Investigation. - -For more information, see the [Mend.io Docker Hardened Images -documentation](https://docs.mend.io/platform/latest/docker-hardened-images). - -## Black Duck - -[Black Duck](https://www.blackduck.com/) identifies Docker Hardened Images and -applies their VEX statements without additional configuration. - -For more information, see the [Black Duck -documentation](https://documentation.blackduck.com/bundle/bd-hub/page/Reporting/vexReport_global.html). - ## Export VEX attestations For scanners that need local VEX files (like Grype or Trivy with local files), diff --git a/content/manuals/dhi/resources.md b/content/manuals/dhi/resources.md index 9f55a2566af..1f7c7e0cf68 100644 --- a/content/manuals/dhi/resources.md +++ b/content/manuals/dhi/resources.md @@ -1,39 +1,16 @@ --- title: Docker Hardened Images resources linktitle: Additional resources -description: Additional resources including product information, blog posts, and GitHub repositories for Docker Hardened Images +description: Additional resources including product information, guides, and GitHub repositories for Docker Hardened Images weight: 999 --- This page provides links to additional resources related to Docker Hardened -Images (DHI), including blog posts, guides, Docker Hub resources, and GitHub -repositories. +Images (DHI), including guides, Docker Hub resources, and GitHub repositories. For product information and feature comparison, visit the [Docker Hardened Images product page](https://www.docker.com/products/hardened-images/). -## Blog posts - -The following blog posts provide insights into Docker Hardened Images, security -features, and announcements: - -| Date published | Title | -|------|-------| -| May 5, 2026 | [Precision Container Security with Docker and Black Duck](https://www.docker.com/blog/precision-container-security-with-docker-and-black-duck/) | -| April 14, 2026 | [Why We Chose the Harder Path: Docker Hardened Images, One Year Later](https://www.docker.com/blog/why-we-chose-the-harder-path-docker-hardened-images-one-year-later/) | -| April 8, 2026 | [Reclaim Developer Hours through Smarter Vulnerability Prioritization with Docker and Mend.io](https://www.docker.com/blog/reclaim-developer-hours-through-smarter-vulnerability-prioritization-with-docker-and-mend-io/) | -| March 3, 2026 | [Announcing Docker Hardened System Packages](https://www.docker.com/blog/announcing-docker-hardened-system-packages/) | -| January 25, 2026 | [Making the Most of Your Docker Hardened Images Enterprise Trial - Part 3](https://www.docker.com/blog/making-the-most-of-your-docker-hardened-images-enterprise-trial-part-3/) | -| January 24, 2026 | [Making the Most of Your Docker Hardened Images Enterprise Trial - Part 2](https://www.docker.com/blog/making-the-most-of-your-docker-hardened-images-enterprise-trial-part-2/) | -| December 19, 2025 | [Docker Hardened Images: Security Independently Validated by SRLabs](https://www.docker.com/blog/docker-hardened-images-security-independently-validated-by-srlabs/) | -| December 17, 2025 | [A Safer Container Ecosystem with Docker: Free Docker Hardened Images](https://www.docker.com/blog/docker-hardened-images-for-every-developer/) | -| November 14, 2025 | [Making the Most of Your Docker Hardened Images Enterprise Trial - Part 1](https://www.docker.com/blog/making-the-most-of-your-docker-hardened-images-trial-part-1/) | -| October 15, 2025 | [Docker Hardened Images: Crafted by Humans, Protected by AI](https://www.docker.com/blog/docker-hardened-images-crafted-by-humans-protected-by-ai/) | -| September 29, 2025 | [Expanding Docker Hardened Images: Secure Helm Charts for Deployments](https://www.docker.com/blog/docker-hardened-images-helm-charts-beta/) | -| August 6, 2025 | [The Next Evolution of Docker Hardened Images: Customizable, FedRAMP Ready, AI Migration Agent, and Deeper Integrations](https://www.docker.com/blog/the-next-evolution-of-docker-hardened-images/) | -| August 6, 2025 | [Accelerating FedRAMP Compliance with Docker Hardened Images](https://www.docker.com/blog/fedramp-compliance-with-hardened-images/) | -| May 19, 2025 | [Introducing Docker Hardened Images: Secure, Minimal, and Ready for Production](https://www.docker.com/blog/introducing-docker-hardened-images/) | - ## Guides For guides that demonstrate how to use Docker Hardened Images in various