# docker scout and docker scan Command Reference

> Reference for docker scout in CI: scan an image for CVEs with cves and compare, plus the deprecated docker scan, to gate releases on vulnerabilities.

Source: https://latchkey.dev/learn/command-reference/docker-scout-command-reference  
Updated: 2026-06-26

Scan images for known vulnerabilities.

docker scout is the current image vulnerability tool; docker scan (Snyk-based) is deprecated and removed from recent Docker versions. In CI, scout analyzes an image against CVE databases and can fail the build when severe vulnerabilities are found.

## Common subcommands and flags

- `docker scout cves IMAGE` - list CVEs affecting the image
- `docker scout quickview IMAGE` - summary of vulnerabilities by severity
- `docker scout compare --to BASE IMAGE` - diff vulnerabilities against a baseline
- `--exit-code` - return non-zero when issues are found
- `--only-severity` - limit to severities, e.g. critical,high

## Example

```shell
docker scout cves --only-severity critical,high --exit-code myorg/app:${{ github.sha }}
```

## In CI

Run docker scout cves with --exit-code and --only-severity critical,high as a gate that fails the pipeline on serious CVEs. Prefer scout over the legacy docker scan, which is no longer bundled with Docker. Use scout compare to block PRs that add vulnerabilities relative to the base branch.

## FAQ

### docker scout and docker scan Command Reference?

docker scout is the current image vulnerability tool; docker scan (Snyk-based) is deprecated and removed from recent Docker versions. In CI, scout analyzes an image against CVE databases and can fail the build when severe vulnerabilities are found.

### In CI?

Run docker scout cves with --exit-code and --only-severity critical,high as a gate that fails the pipeline on serious CVEs. Prefer scout over the legacy docker scan, which is no longer bundled with Docker. Use scout compare to block PRs that add vulnerabilities relative to the base branch.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt