Docker Scout

Node catalog Actions

On this page

Scan Docker / OCI registry images for security CVEs with Docker Scout.

Usage and specifics

Supply the image to scan and an available Docker or Podman target. failOn sets the threshold that fails the node. Trivy also accepts target=repository with a checkout workspace and relative path to scan before building. Scanners and their databases must be accessible; detected secret values are redacted.

Technical type : docker_scout. Runtime : docker.

Credentials and prerequisites

This node defines no dedicated external credential. Remote sources or execution targets may still need their own access credentials.

See the credentials guide if a remote source or execution target requires access.

Parameters

Names below are technical keys. Defaults are not a ready-to-run configuration: complete fields required by your operation. Paths containing [] describe list items; some fields depend on the selected mode.

Parameter	Type	Default	Values / limits
`image`	`string`	`""`	-; max 2000
`scannerImage`	`string`	`""`	-; max 512
`platform`	`string`	`""`	-
`ignoreUnfixed`	`boolean`	`false`	-
`failOn`	`enum`	`"none"`	`none`, `low`, `medium`, `high`, `critical`
`timeoutMs`	`number`	`600000`	-; ≥ 10000, ≤ 1800000

Configuration help

image Image to scan: Reference to an image published in a registry. Expressions and build node outputs are supported. Push local images before scanning. For a private registry, place a Docker / Podman login node before this scan. Credentials remain scoped to this run.
failOn Block the workflow at: The threshold includes higher severities. Report only keeps all findings in the output. Reaching a threshold fails the node with a summary in its logs; the full report is then unavailable as a successful output. Unknown severities do not trigger the threshold.
ignoreUnfixed Only show fixable vulnerabilities: Excludes vulnerabilities without an available fixed version, including from the blocking threshold. Configuration and secret checks remain active.
platform Target platform: Optional: image architecture to scan, such as linux/amd64 or linux/arm64. When empty, the scanner selects its default platform.
timeoutMs Timeout (seconds): Between 10 and 1,800 seconds. Includes downloading the scanner, target image and vulnerability databases.
scannerImage Scanner image: Optional: overrides the suggested official image. Pin a version or digest for reproducible scans. Use a trusted image: it accesses source code in repository mode or registry credentials in image mode. Requires Docker or Podman on the host. Kubernetes and SSH targets are unsupported. Repository mode scans the checkout directory mounted read-only, without registry credentials or an engine socket. Docker Scout requires an authorized Docker Hub account. Add a Docker / Podman login to docker.io before this node, in addition to the private registry login when needed.

Initial configuration

Initial catalog configuration example, to adapt before running. Keep secrets in credentials.

json

{
  "image": "",
  "scannerImage": "",
  "platform": "",
  "ignoreUnfixed": false,
  "failOn": "none",
  "timeoutMs": 600000
}

Verification

Test with representative data. Check node output in the inspector and logs, then use editor mapping for downstream fields. A trigger test with a simulated payload does not validate external service delivery.