## Summary
Standardize the Docker Scout CLI command on `docker scout` (with space)
across the CircleCI and Jenkins integration guides so it matches the
format used in `azure.md`, `gitlab.md`, and the rest of the Scout docs
(`install.md`, `quickstart.md`, `gha.md`).
## Issue
Fixes#24843
## Changes
- `content/manuals/scout/integrations/ci/circle-ci.md`: change
`docker-scout cves …` to `docker scout cves …`
- `content/manuals/scout/integrations/ci/jenkins.md`: change
`docker-scout cves …` to `docker scout cves …`
Other references to `docker-scout` that are not CLI invocations (the
binary filename in `install.md`, the GitHub Action step `id:
docker-scout` in `gha.md`, external URLs, and Azure resource names) are
intentionally left unchanged.
## Testing
- Docs-only change. Diff is two lines, no content rewrites.
Signed-off-by: Niels Kaspers <kaspersniels@gmail.com>
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
The code snippet for Dockerfile under the "Using the official Docker
images" contains a comment which says that this Docker file uses DHI
image, which is incorrect.
<!--Delete sections as needed -->
Updated the code snippet to match the tab contents
<!-- Tell us what you did and why -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
Fixes#24818.
The `[!IMPORTANT]` callout at the top of
`content/manuals/dhi/how-to/build.md` read:
> You must authenticate to the Docker Hardened Images registry
(`dhi.io`) to pull base images and build tools. [...]
Phrased that way it reads as if any Dockerfile using a DHI base image
(e.g. `FROM dhi.io/python:3.13`) needs a special authentication step
specific to the build page. The real reason is scoped: the DHI build
frontend itself pulls from `dhi.io` when processing a YAML definition
file.
Rewritten to tie the requirement explicitly to the DHI build system and
to the act of building a definition file, so readers don't extrapolate
the requirement to unrelated Dockerfile usage. Wording around the Docker
ID credentials is preserved.
Fixes#24819.
In `content/manuals/dhi/how-to/customize.md` the Docker Hub tab jumped
from "select the repository / select the tag" straight to "images later
in the list will overwrite files from earlier images" without first
establishing that multiple OCI artifacts can be added or how their
ordering is determined in the UI. Readers understood the consequence but
not the mechanism.
Adds one short paragraph before the overwrite rule to anchor the reader:
- multiple OCI artifacts can be added to a single customization,
- they're applied in the order they're added in the **OCI artifacts**
drop-down.
The overwrite rule is rephrased to:
- refer to "images added later / images added earlier" for consistency
with the new paragraph,
- use "If multiple images contain directories or files with the same
path" (the rule applies to any N≥2, not just two),
- use "directories or files" instead of the existing "directories and
files", which could be read as requiring both types in the same artifact
for the rule to apply.
No change to the subsequent paragraphs about include/exclude paths.
Fixes#24743.
The authentication note at the top of
`content/manuals/dhi/migration/examples/python.md` was the stripped-down
version, missing:
- the indication that `docker login dhi.io` expects Docker ID
credentials
- the detail that those are the same credentials as Docker Hub
- the link to the account creation page
The equivalent notes in `go.md` (lines 24-29) and `node.md` (lines
24-29) carry all three. This PR copies the full paragraph into
`python.md` so Python readers get the same onboarding guidance.
No other content changed.
Fast follow ups:
- Returned aliases with new alias to one doc
- Updated provision index page to accurately reflect different methods
- reorganized table to reflect popularity of methods based off sme info
(scim is the vogue, then JIT, then auto provision)
- Updated grid to link correctly to auto provisioning doc
- Created more opinionated left nav to reflect recommendations around
security SCIM > JIT > auto
- Fixed `*`s to be `-`s
- Updated Migrate doc heading levels
<!--Delete sections as needed -->
## Description
<!-- Tell us what you did and why -->
## Related issues or tickets
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
Adds a troubleshooting note on the Fedora install page for the case
where the Docker service fails to start with `failed to find iptables`
in the logs, pointing users to set the `iptables` alternative to
`iptables-nft`.
Closes#23186
<!--Delete sections as needed -->
## Description
Adds documentation for `network_mode: bridge` in the Compose file
reference.
While `bridge` is a valid and functional network_mode option that
connects
containers to the host's default bridge network, it was not documented
alongside the other options (none, host, service, container).
Fixes#24742.
- #24742
<!-- Related issues, pull requests, or Jira tickets -->
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [x] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Signed-off-by: Mahitha Adapa <mahitha.ada@gmail.com>
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
The `security_opt` field in the Compose services reference did not
document
the accepted syntax variants, which was confusing for users.
Added a note explaining that options accept `option=value`,
`option:value`,
or bare `option` syntax (for booleans). Added examples showing all three
equivalent forms for `no-new-privileges`.
The option is parsed as a boolean by strconv.ParseBool, so 'disabled'
wasn't a valid value and misled readers. Align the default with the
in-file convention used by max-size and max-file.
Closes#21898
<!--Delete sections as needed -->
## Description
- Remove tier badges from all DHI topics except `/dhi/features/` since
the summary bar already conveys subscription tier info
- Update tier badges in `/dhi/features/` from `&` to `or` to match the
prose and clarify that either DHI Select or Enterprise provides the
feature
- Add summary bars to sections in `cli.md` and `hardened-packages.md`
that previously only had badges
- Add new `Docker Hardened Images Enterprise` summary bar variant for
Enterprise-only sections
## Related issues or tickets
Closes#24732
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
## Summary
- Clarify that `/etc/sandbox-persistent.sh` is sourced when bash runs
inside
the sandbox, but not when `sbx exec <name> <command>` runs a command
directly without a shell. Add a `bash -c` workaround.
(Related: docker/sbx-releases#53)
- Add FAQ entry explaining why agents run without approval prompts (the
sandbox is the safety boundary) and how to re-enable them: change the
permission mode inside the session, or build a custom template.
(Related: docker/sbx-releases#47)
- Add a note to the network policy page and a troubleshooting entry
making
it explicit that SSH and other non-HTTP protocols are always blocked,
regardless of allow rules. (Related: docker/sbx-releases#46)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Description
Refreshing and reducing left nav sprawl.
- Removed management topic. It's not a standalone use-case. The use-case
is managing mirrored and customized repos, so moved the info into those
topics to reduce left nav sprawl.
- For Mirror and Customize:
- Moved Hub and CLI workflows to tabs.
- Added Terraform tab showing how to manage mirrors and customizations
using the [DHI Terraform
provider](https://registry.terraform.io/providers/docker-hardened-images/dhi/latest/docs).
The mirror topic includes provider setup (install + auth), and the
customize topic links back to it.
- Added additional related CLI commands in order to eventually remove
the standalone CLI topic.
- Added necessary token (PAT/OAT) support/scoping for mirroring and
customization.
- Moved the how to use an OAT with oras out of the mirror topic and into
the use topic in the CI/CD section. OATs can't be used to mirror.
Reframed the example to be about oras rather than OAT based on the
requirement. Xref'd to the OAT topic for creation steps.
- Moved webhook section in Mirror from Hub section to third-party mirror
section.
- In Mirror, changed wording from "mirror to hub" to "mirror to your
organization" to be more specific.
- Added warning for examples using credentials in CLI
Previews
-
https://deploy-preview-24616--docsdocker.netlify.app/dhi/how-to/mirror/
-
https://deploy-preview-24616--docsdocker.netlify.app/dhi/how-to/customize/
-
https://deploy-preview-24616--docsdocker.netlify.app/dhi/how-to/use/#discover-attestations-with-oras
## Related issues or tickets
ENGDOCS-3222 - topic refresh
ENGDOCS-3224 - add token scopes
ENGDOCS-3231 - add terraform
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
- [ ] Technical review
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
The "Removing all state" section only covered macOS and Windows.
Add a Linux tab documenting the XDG-based paths for sandbox state,
cache, and config directories.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
<!--Delete sections as needed -->
## Description
### Summary
- Add new Explore topic documenting how Docker scans DHI images for
malware using ClamAV, including how to retrieve and verify the virus
scan attestation
- Update the base and customized build pipeline descriptions to include
scanning (malware, secrets, vulnerabilities) as an explicit pipeline
step
- Add cross-references from the attestations page to the new malware
scanning topic
### Details
DHI images include a signed virus/malware scan attestation
(`https://scout.docker.com/virus/v0.1`), but this wasn't documented
anywhere beyond a one-line mention in the attestations table. This PR
adds a dedicated Explore topic for it and integrates scanning into the
build pipeline documentation.
The attestation content was verified by pulling actual attestations from
both a base image (`dhi.io/python:3.13`) and a customized image
(`projectsteam/dhi-python-3:3.10-alpine3.22_curl`). Key findings that
informed the docs:
- The virus scan uses **ClamAV** (`clamav/clamav:stable`), scanning all
OCI blobs including archives
- The attestation payload is JSON with a base64-encoded ClamAV report
- Both base and customized images get virus, secrets, and vulnerability
scanning
- Only base images get the functional **test** attestation — customized
images do not
### Notable generated topics
-
https://deploy-preview-24729--docsdocker.netlify.app/dhi/explore/malware-scanning/
-
https://deploy-preview-24729--docsdocker.netlify.app/dhi/explore/build-process/
## Related issues or tickets
Closes#24728
## Reviews
<!-- Notes for reviewers here -->
<!-- List applicable reviews (optionally @tag reviewers) -->
- [ ] Editorial review
---------
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
Neither named nor anonymous volumes use outside sources, those are for bind mounts.
Additionally, referring to a volume's name as a "source" here can be confusing (even though correct), as the term has a different definition for bind mounts.
The userns-remap page had no mention of rootless mode, so users didn't
know about the alternative. Added a note clarifying that userns-remap
still runs the daemon as root, with a link to rootless mode. The
rootless page already links back to userns-remap.
Co-Authored-By: Claude <noreply@anthropic.com>
The overview and introduction pages described Bake as supporting "HCL,
JSON, or YAML formats", implying a standalone YAML bake file format
exists. Reworded to clarify that HCL and JSON are native Bake file
formats, while YAML support means Bake can build from a Compose file.
Co-Authored-By: Claude <noreply@anthropic.com>
Explicitly state the dangers if a port mapping binds to all interfaces
## Description
<!-- Tell us what you did and why -->
We recently discovered that docker was bypassing our firewall rules when
forwarding ports from a container using the standard `<host
port>:<container port>` syntax. What this meant was that the container
was effectively visible to the entire internet. It was only after some
digging did we discover that it is possible and even recommended to
explicitly bind the host port to localhost so it doesn't accept
connections from everywhere. This PR updates the docs to explicitly
state the potential dangers of not specifying a localhost when exposing
docker container ports.
## Reviews
- [ ] Technical review
- [ ] Editorial review
- [ ] Product review
---------
Co-authored-by: Allie Sadler <102604716+aevesdocker@users.noreply.github.com>
The previous text incorrectly conflated page faults with segmentation
faults (SIGSEGV). Page faults are a normal part of virtual memory
management that occur when a process accesses a page not currently in
physical memory. Removed the incorrect SIGSEGV reference and clarified
that page faults are expected behavior, not errors. Also fixed minor
grammar issues.
Fixes#19338
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Clarify that HTTPS_PROXY specifies the proxy for HTTPS requests, not
that the proxy itself uses HTTPS. Change example URLs from
https://proxy.example.com:3129 to http://proxy.example.com:3128 since
most proxies accept HTTP connections and use CONNECT tunneling for
HTTPS traffic. Also fix "non-HTTPS and a HTTPs proxy" casing.
Fixes#20817
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
