Discrepancies in Docker Scout security report data between macOS hosts vs Windows hosts
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 454
- Forks
- 134
- PR merge metrics
- No merged PRs in 30d
Description
docker scout cves -e fs://... often reports "No vulnerabilities" on Windows hosts, where macOS hosts do show findings, for the very same local file tree.
This happens when scanning the snyk-linux v1.1268.2.
https://github.com/snyk/cli/releases/tag/v1.1298.2
The problem appears to be specific to SBOM's collected via the local file system with fs://... By comparison, image scans seem to be consistent across Docker host operating systems.
Here's a quick idea for a practical solution: Go ahead an synthesize a dummy image housing the local files in question, then scan that. Perhaps that would fix security reporting on more hosts.
Please ensure that Docker Scout generates full, complete, and identical security reports, independent of which host OS is involved.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing docker scout cves -e fs:// against the same local file tree on macOS and Windows, using the reported snyk-linux version. Compare the generated SBOM and vulnerability reports with the corresponding image scan, then determine whether the reports become complete and identical across host operating systems.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell
- Domain
- cli, operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100