docker / docker/scout-cli

Docker Scout fails to recognise DHI base image

Open
#212 4 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
454
Forks
134
PR merge metrics
No merged PRs in 30d

Description

Github Actions pipeline run for reference -> https://github.com/unixerius/proxmox-qdevice/actions/runs/21072965388/job/60607307451

The same issue occurs with Scout as integrated into Docker Hub -> https://hub.docker.com/repository/docker/unixerius/proxmox-qdevice/general

The containers that are being built are based off of Docker's DHI (docker hardened image) Debian Base image -> https://hub.docker.com/hardened-images/catalog/dhi/debian-base

The Docker Buildx instructions for my containers include the options for --sbom and --provenance mode=max. Both Buildx and Scout confirm that provenance information is included in the image.

Regardless, Docker Scout fails to recognise the base image.

Logs from the pipeline run:

Run docker/scout-action@v1
  with:
    command: quickview,cves
    image: ghcr.io/***/proxmox-qdevice:bookworm
    ignore-unchanged: true
    only-severities: critical,high
    github-token: ***
    summary: true
    format: json
    write-comment: true
  env:
    registry: ***
    image: proxmox-qdevice
quickview
      ✓ SBOM obtained from attestation, 135 packages found
      ✓ Provenance obtained from attestation
  Error: image has no base image

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the docker/scout-action@v1 invocation and its quickview,cves output, then inspect how Scout obtains and interprets the SBOM and provenance attestations for the linked DHI Debian base image. Done means Scout recognises the DHI base image instead of reporting "image has no base image" in the provided pipeline and Docker Hub cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, github-actions
Domain
cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.