alpine/used-for-docker-scout-score-check-only repository overview

There are no useful tools in this image; its sole purpose is to test the Docker Scout score and debug the code to achieve a higher score.

For instance, with the following simple Dockerfile,

FROM alpine

RUN apk fix && \
    apk --no-cache --update add git git-lfs gpg less openssh patch perl && \
    git lfs install

VOLUME /git
WORKDIR /git

ENTRYPOINT ["git"]
CMD ["--help"]

I received an 'E' score due to several issues:

• Fixable critical or high vulnerabilities found
• No unapproved base images
• Missing supply chain attestation(s)
• No outdated base images
• No default non-root user found

I’d like to start by addressing the easiest issues to fix:

• No unapproved base images
• No outdated base images

⁠Update 1

with below command, I fixed both issue No outdated base images and No unapproved base images after manually build locally and push the image:

docker buildx build --tag alpine/used-for-docker-scout-score-check-only:v2 \
    --push --attest type=provenance,mode=max .

ref:

• https://docs.docker.com/scout/policy/#no-outdated-base-images⁠
• https://docs.docker.com/build/metadata/attestations/slsa-provenance/⁠

⁠Update 2

Above command docker buildx build works fine on my macbook, but doesn't work with option --attest in pipeline, when refereeing Docker's official document (https://docs.docker.com/scout/integrations/ci/circle-ci/⁠) , I got this error

unknown flag: --attest
See 'docker buildx build --help'.

ref: https://app.circleci.com/pipelines/github/alpine-docker/used-for-docker-scout-score-check-only/6/workflows/92cbda51-6ef8-4d56-89a5-a272817976a7/jobs/3⁠

⁠Update 3

Switch to use Github Action Pipeline, the Scout rank is B now, that's great.

Github Action Pipeline for reference: https://github.com/alpine-docker/used-for-docker-scout-score-check-only/blob/master/.github/workflows/build.yml⁠