Securing the software supply chain with Docker Scout and Amazon ECR
summary
Docker Scout links to Amazon ECR via a small CloudFormation stack and SNS event feed to pull image metadata (packages, licenses, SBOM and provenance) without changing any push workflows. Policies score images and give actionable remediation — e.g., Scout recommends upgrading Alpine 3.14 → 3.18 and shows that change removes two critical and 16 high issues (26 vulnerabilities total). Integrations include the Docker CLI, Docker Scout Compare for local vs production diffs, and CI actions (GitHub) for continuous policy evaluation while Scout acts as the system of record.
AI-written summary · about
chapters (10)
- 0:00Introduction to Docker Scout
- 2:09Supply chain challenges explained
- 6:12Docker Scout and ECR integration
- 9:23Setting up AWS CloudFormation stack
- 11:52Building and pushing images
- 12:56Exploring vulnerabilities in images
- 14:40Using policies for smarter fixes
- 16:48Updating base images locally
- 17:10Comparing images for production
- 19:18Resources and next steps
related talks
21mSecuring Dockerized apps in the Microsoft ecosystem
34mDelivering Continuous Security with Docker
18mPractical End-to-End Container Security at Scale
44mDocker for DevSecOps
38mSecuring the chains: Building defensive layers for software supply chains
32mWhat Data Tells Us About Software Supply Chain Security & What To Do About It
32mA Security State Of Mind: Compliance and ...
21mWhat is the Best Container Security Workflow for Your Organization?