If you have been using Docker scan to check on CVE errors, well docker scan has been discontinued, and now we have Docker scout. I am using this in my gitlab scanner ubuntu server, since most of my build image are temporary store here.
To install the new Docker scout on Ubuntu, lets make a directory, then get the installation
<pre><code class="lang-plaintext">mkdir ./docker/cli-plugins
curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
</code></pre>
After that you can use it, to start using docker scout, you need to perform docker login.
<pre><code class="lang-plaintext">docker login
docker scout cve &lt;image-name&gt;
</code></pre>
The usage of docker scout sve &lt;image-name&gt; itself will return the cve vulnerability. This covers both base image and application.
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1688457636619/35daf20e-c369-4e33-9b66-1306267a2b51.png" alt class="image--center mx-auto" />
if you would like to ignore the base image use this
<pre><code class="lang-plaintext">docker scout cve &lt;image-name&gt; --ignore-base
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1688457747803/fca0df04-c085-4cfc-8b1e-d87da0442faf.png" alt class="image--center mx-auto" />
This comes back to the question, since my project has MEDIUM vulnerability, so how do i check. I am using node thus, i can check using
<pre><code class="lang-plaintext">npm list -a
</code></pre>
<img src="https://cdn.hashnode.com/res/hashnode/image/upload/v1688457918810/07c62fd2-8b19-4a5c-a79d-63eae2010135.png" alt class="image--center mx-auto" />
Unfortunately, nodemon at this point of writing is still on the same version as listed, thus for now I would not be able to update it. So there you have it on how to use docker scout. You can integrate it within CI pipeline before testers test them, or for developers after performing docker build on your test machine.

If you have been using Docker scan to check on CVE errors, well docker scan has been discontinued, and now we have Docker scout. I am using this in my gitlab scanner ubuntu server, since most of my build image are temporary store here.

To install the new Docker scout on Ubuntu, lets make a directory, then get the installation

```plaintext
mkdir ./docker/cli-plugins
curl -sSfL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh -s --
```

After that you can use it, to start using docker scout, you need to perform docker login.

```plaintext
docker login
docker scout cve <image-name>
```

The usage of docker scout sve &lt;image-name&gt; itself will return the cve vulnerability. This covers both base image and application.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688457636619/35daf20e-c369-4e33-9b66-1306267a2b51.png align="center")

if you would like to ignore the base image use this

```plaintext
docker scout cve <image-name> --ignore-base
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688457747803/fca0df04-c085-4cfc-8b1e-d87da0442faf.png align="center")

This comes back to the question, since my project has MEDIUM vulnerability, so how do i check. I am using node thus, i can check using

```plaintext
npm list -a
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1688457918810/07c62fd2-8b19-4a5c-a79d-63eae2010135.png align="center")

Unfortunately, nodemon at this point of writing is still on the same version as listed, thus for now I would not be able to update it. 
So there you have it on how to use docker scout. You can integrate it within CI pipeline before testers test them, or for developers after performing docker build on your test machine.

Part 6 CI: Installing docker scout