Never use a Docker container without doing this first! (And don't create one either!) 

Don't make the mistake of downloading (pulling) a Docker container without first doing this very important security check! So many Docker containers contain software that have CVEs (Common Vulnerabilities and Exposures). And don't create a Docker container without first making sure that the dependencies you use don't have CVEs. Make the world a more secure place by using Docker Scout. Big thanks to Docker for sponsoring this video! // Learn more here // Docker Scout: dockr.ly/4engpsI Docker www.docker.com/ // PDF // Docker Scout PDF: davidbombal.wiki/dockerscoutpdf // David's SOCIAL // Discord: discord.com/invite/usKSyzb X: twitter.com/davidbombal Instagram: instagram.com/davidbombal LinkedIn: www.linkedin.com/in/davidbombal Facebook: facebook.com/davidbombal.co TikTok: tiktok.com/@davidbombal RU-vid: www.youtube.com/@davidbombal // MY STUFF // www.amazon.com/shop/davidbombal // MENU // 00:00 - Introduction 00:35 - Docker Scout Demo 04:58 - Key Takeaways 05:52 - Install Docker Desktop 06:16 - Download GIT 08:19 - Launch GIT BASH 09:00 - Open PowerShell 09:26 - Pull and Analyze the Container 10:15 - Advantages of Docker Scout 11:25 - Demo: Finding and Fixing Vulnerabilities 12:42 - Login to Docker Scout 13:44 - Enable Docker Scout 14:18 - Overview 16:15 - Docker Desktop 17:36 - Update Dockerfile 18:10 - Build and Push Updated Docker Container 18:51 - Fixing Vulnerabilities 20:14 - No Recommended Fixes 21:25 - Options for Discovering Vulnerabilities 22:26 - Fixed Vulnerabilities 23:39 - Further Fixes 25:42 - Achieving 100% Compliance 25:59 - The Power of Docker Scout 26:18 - Outro cve docker docker scout scout docker hub docker cve rust java jscript xss c python #docker #hack #docker

i've often said, just because it runs in a VM doesn't make it safe, when you download a container you are basically bringing a foreign system onto your network

I do this job regularly. To be FedRAMP compliant you need to ship vulnerable free image into production environment

He's talented and deserves respect because he paid his dues. ❤😂

Brilliant video for developers! Thank you so much David!

Great PSA David. Thank you!

This is exactly why I don't like containers. It is too easy to slip in vulnerabilities especially in high use networks.

Thanks a lot, David. Fantastic advice and demo👍🏻👍🏻😇

Thanks so much David ❤

The issue detailed by the CVE has to be exposed by the container or accessable via services offered by the contained application.

Many thnx, David!

WOW!!! Thanks for this info!!!!! Greatly appreciated!!!

The problem I have is we use one docker image in the entire company. The IT manager isn't going to pay for docker scout.

The fundamental problem today is that container images have unnecessary binaries and libraries in the container. I deal with this every single day and then to make matters worse the licensing of those packages isn't being complied with (GPL). Trivy is better and then use Dive to actually analyze the layers if the image hasn't been squashed. The concept of least privilege needs to be applied to most minimalist packages in a base container OS.

You might want to disable ClearType when zooming in to UI elements containing text, I really hate the colour fringe that appears when the text does not align with my subpixels.

Great tutorial man !

Great video. Docker and Docker Scout are great development tools; but nobody has created Zero Trust containers, yet. (Armored Gate is working on that.)

I really like this video as it shows how patient you need to be to understand and then to implement safeguards against CVE's. Linking this to an earlier video where @davidbombal interviewed someone from Cisco; recall eBPF. Apparmor and SELinux could also be leveraged in cases where the operator does not have the privileges to modify the software. My suggestion is more towards safeguarding or CUA till official patch from vendors arrive. Please let me know if there is any other way to proceed.

This man is a great salesman

Thank you for posting

Thats great, what's the FOSS option?

Thank you. Very useful video.

Excellent presentation and valuable information. Thank you Just a question: Why not to use Chainguard images which provide 0 vulnerability?

Very useful advise! Thank you!

Interesting! Thank you for the information! Edit: I learn CVE from CompTIA A + core 2 and it's cool!

I'm not sure it's usefull: the point of using the original vendor image is to get something stable that has been tested by the vendor. If you're running a custom version, why would you upgrade their image instead of building a new one from scratch?

If docker owns docker scout then they know which images are vulnerable. They have a moral obligation to deploy fixes and flaw prevention at their level.

It's not just vulnerabilities, but also the fact that some images shouldn't be trusted in the first place.

Have you used Snyk? How do you think Scout compares?

Muy bueno. Sigue asi David,

But cve are everywhere - only isolation of docker host from rest of infrastructure is a solution - that is - do not use docker locally

Scout is a paid, closed-source product by Docker, IIRC. What about talking about open source alternatives like Clair, Trivy, Anchor, Dragda or Grype, to name a few?

What to do when absolutely all containers have CVE ? It's not possible to have clean containers when all the dependencies are vulnerables, and if you try to fix it, you're going to suffer a lot, just because people are crafting crappy containers and expects you to do their work

Hi sir, which is better for beginners Kali or parrot?

Thanks so much sir

I thought I'll find advice for shipping containers😮

Does it work for pods?

create your own docker image

Where is Mr otw ?

Thanks 👍🎉❤

Hi David, could you check your email and search Doris to see if you have cooperation intention?

David, What do you do before using a large language model you did not create? Is #AI the new spyware from who knows where?

Been an issue for a while now...

5:50 NEVER install docker desktop... stick to networking Sir David.

Sir please add the function Hindi language in your RU-vid video please 🙏🙏🙏🙏

😮

🙂👍

Lol 😂😂😂😂 You do understand nothing hahaha 🤣 You got Skill issues

All the zooming in and out makes the procedure confusing to follow. 🫤 - Mr Boomer