Docker hub

• docker provided remote repos for store images.

• docker hub ==> docker scan <org>/<image_repo>:<tag> – docker hub

• acr

• ecr

• nexus ==> dockerimages, helm charts, artifacts, packages like go, python, maven …etc <org>/<reponame>/<subfolder>/<image_repo>:<tag>

• jforg ==> dockerimages, helm charts, artifacts, packages like go, python, maven …etc && Xray (scan image to get secuity vul…) <org>/<reponame>/<subfolder>/<image_repo>:<tag>

Docker Hardened Image: modified images Docker Official Image: Official images by company Verified Publisher: products Verified images Sponsored OSS: some Sponsored images customized versions

docker desktop :

• free invidual user
• 2m <= company anual imcome must should 2 milions
• 16Gb ram local you can use

docker login

docker login <org>

ex: docker login mcd.jforg.io

1. userName
2. pat token (api token)

docker login -u ramqt2205

![login](image-7.png)

create tag while build image

docker build -t <imageName>:<version>

change tag or create new tag for existing image

docker tag <imageName>:<version> <org>/<imagename>:<version>

docker tag spring:1.2-ubuntu ramqt2205/demo-web-app:1.0.3-build-77

docker push will pushing image to remote repo

docker push ramqt2205/demo-web-app:1.0.3-build-77

logout

docker logout

docker logout <org> docker logout mcd.jfrog.io

docker scan

# 1. Download the installation script
curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh -o install-scout.sh

# 2. Run the script to install the plugin
sh install-scout.sh

Turn on Docker Scout image analysis
Sign in to Docker Hub.

Select My Hub > Repositories.

A list of your repositories appears.

Select a repository.

The General page for the repository appears.

Select the Settings tab.

Under Image security insight settings, select Docker Scout image analysis.

Select Save.

docker scout cves ramqt2205/demo-web-app:1.0.3-build-77

• alternate
• xray
• aqua/
• veracode
• trivy scan image

sudo apt-get install wget apt-transport-https gnupg lsb-release
wget -qO - https://github.io | gpg --dearmor | sudo tee /usr/share/keyrings/trivy.gpg > /dev/null
echo "deb [signed-by=/usr/share/keyrings/trivy.gpg] https://github.io $(lsb-release -sc) main" | sudo tee /etc/apt/sources.list.p/trivy.list
sudo apt-get update
sudo apt-get install trivy

Xray Main – 2026