Skip to content

Commit 7b9471d

Browse files
Add: Add quickstart.md improvements (#22272)
## Description I did some improvements to the quickstart.md file, adding images and improve some descriptions to be albe to helo learners to find the references mentioned in the file. ## Related issues or tickets No related issues or ticket. ## Reviews <!-- Notes for reviewers here --> <!-- List applicable reviews (optionally @tag reviewers) --> - [ ] Technical review - [ ] Editorial review - [ ] Product review --------- Co-authored-by: Craig Osterhout <[email protected]>
1 parent e2f2680 commit 7b9471d

File tree

1 file changed

+15
-13
lines changed

1 file changed

+15
-13
lines changed

content/manuals/scout/quickstart.md

+15-13
Original file line numberDiff line numberDiff line change
@@ -84,26 +84,24 @@ Learn more about the `docker scout cves` command in the
8484

8585
## Step 4: Fix application vulnerabilities
8686

87-
The fix suggested by Docker Scout is to update
88-
the underlying vulnerable express version to 4.17.3 or later.
87+
After the Docker Scout analysis, a high vulnerability CVE-2022-24999 was found, caused by an outdated version of the **express** package.
8988

90-
1. Update the `package.json` file with the new package version.
89+
The version 4.17.3 of the express package fixes the vulnerability. Therefore, update the `package.json` file to the new version:
9190

9291
```diff
9392
"dependencies": {
9493
- "express": "4.17.1"
9594
+ "express": "4.17.3"
9695
}
9796
```
98-
99-
2. Rebuild the image with a new tag and push it to your Docker Hub repository:
97+
98+
Rebuild the image with a new tag and push it to your Docker Hub repository:
10099

101100
```console
102101
$ docker build --push -t <ORG_NAME>/scout-demo:v2 .
103102
```
104103

105-
Now, viewing the latest tag of the image in Docker Desktop, the Docker Scout
106-
Dashboard, or CLI, you can see that you have fixed the vulnerability.
104+
Run the `docker scout` command again and verify that HIGH CVE-2022-24999 is no longer present:
107105

108106
```console
109107
$ docker scout cves --only-package express
@@ -154,7 +152,7 @@ $ docker scout config organization <ORG_NAME>
154152

155153
Now you can run the `quickview` command to get an overview
156154
of the compliance status for the image you just built.
157-
The image is evaluated against the default policy configurations.
155+
The image is evaluated against the default policy configurations. You'll see output similar to the following:
158156

159157
```console
160158
$ docker scout quickview
@@ -209,7 +207,7 @@ The classic image store doesn't support manifest lists,
209207
which is how the provenance attestations are attached to an image.
210208

211209
Open **Settings** in Docker Desktop. Under the **General** section, make sure
212-
that the **Use containerd for pulling and storing images** option is checked.
210+
that the **Use containerd for pulling and storing images** option is checked, then select **Apply & Restart**.
213211
Note that changing image stores temporarily hides images and containers of the
214212
inactive image store until you switch back.
215213

@@ -230,7 +228,9 @@ results through a different lens: the Docker Scout Dashboard.
230228
3. Select **Images** in the left-hand navigation.
231229

232230
The images page lists your Scout-enabled repositories.
233-
Select the image in the list to open the **Image details** sidebar.
231+
232+
Select the row for the image you want to view, anywhere in the row except on a link, to open the **Image details** sidebar.
233+
234234
The sidebar shows a compliance overview for the last pushed tag of a repository.
235235

236236
> [!NOTE]
@@ -239,13 +239,15 @@ The sidebar shows a compliance overview for the last pushed tag of a repository.
239239
> It might take a few minutes before the results appear if this is your
240240
> first time using the Docker Scout Dashboard.
241241
242-
Inspect the **Up-to-Date Base Images** policy.
242+
Go back to the image list and select the image version, available in the **Most recent image** column.
243+
Then, at the top right of the page, select the **Update base image** button to inspect the policy.
244+
243245
This policy checks whether base images you use are up-to-date.
244246
It currently has a non-compliant status,
245247
because the example image uses an old version `alpine` as a base image.
246248

247-
Select the **View fix** button next to the policy name for details about the violation,
248-
and recommendations on how to address it.
249+
Close the **Recommended fixes for base image** modal. In the policy listing, select **View fixes** button, next to the policy name for details about the violation, and recommendations on how to address it.
250+
249251
In this case, the recommended action is to enable
250252
[Docker Scout's GitHub integration](./integrations/source-code-management/github.md),
251253
which helps keep your base images up-to-date automatically.

0 commit comments

Comments
 (0)