Docker Scout "not authenticated" / login required in CI

By Kaveh Alemi·Latchkey

Docker Scout queries Docker's hosted analysis service, which requires an authenticated Docker Hub session. On a fresh runner with no login, docker scout cves fails asking you to authenticate. Logging in with a token from a secret resolves it.

What this error means

Scout fails before analysis with a message that you are not authenticated or that authorization is required, and prompts you to run docker login.

Docker Scout

WARN Unable to find the container image
FATAL not authenticated: to use Docker Scout, log in with 'docker login' or set
DOCKER_SCOUT_HUB_USER and DOCKER_SCOUT_HUB_PASSWORD

Common causes

The runner has no Docker Hub session

Scout's analysis needs an authenticated Hub account. A clean CI runner is logged out, so the query is rejected.

Credentials not injected from secrets

The Hub username/token were never exposed to the step, so Scout has nothing to authenticate with.

How to fix it

Log in to Docker Hub before running Scout

Store a Docker Hub username and access token as secrets.
Use docker/login-action so the runner has a session.
Run docker scout cves after login.

.github/workflows/ci.yml

- uses: docker/login-action@v3
  with:
    username: ${{ secrets.DOCKERHUB_USERNAME }}
    password: ${{ secrets.DOCKERHUB_TOKEN }}
- run: docker scout cves myimage:latest --only-severity critical,high --exit-code

Provide Scout credentials via env

Alternatively set the Scout Hub env vars from secrets so it authenticates without an interactive login.

.github/workflows/ci.yml

env:
  DOCKER_SCOUT_HUB_USER: ${{ secrets.DOCKERHUB_USERNAME }}
  DOCKER_SCOUT_HUB_PASSWORD: ${{ secrets.DOCKERHUB_TOKEN }}

How to prevent it

Log in to Docker Hub in CI before any docker scout command.
Keep Hub credentials in secrets, referenced by env.
Use an access token, not a password, for the CI login.

Frequently asked questions

What causes "Docker Scout "not authenticated""?