Docker "scout cves" - Command Fails or Gates the Build in CI
docker scout cves analyzes an image for known vulnerabilities. It can fail because the Scout CLI plugin is missing, because it needs a Docker login to analyze, or - by design - because it found CVEs that a policy treats as a failing condition.
What this error means
A docker scout cves <image> step errors with docker: 'scout' is not a docker command, an authentication error, or exits non-zero because vulnerabilities exceeded the configured threshold. The first two are setup problems; the last is the gate working as intended.
docker: 'scout' is not a docker command.
# or: failed to analyze image: authentication required
# or (policy gate): Policy "no critical CVEs" failed - 2 critical vulnerabilities foundCommon causes
The Scout CLI plugin is not installed
On a runner without the Scout plugin, docker scout is an unknown command. It ships with recent Docker Desktop but must be installed separately on bare CI runners.
No Docker login for analysis
Scout authenticates to fetch advisory data and analyze images. Without a docker login, analysis can fail with an authentication error.
A vulnerability policy failed by design
If you run Scout as a gate, a non-zero exit may be the intended result - the image has CVEs that exceed your threshold, and the job is meant to fail.
How to fix it
Install the Scout plugin and authenticate
Install the CLI plugin and log in before analyzing.
curl -fsSL https://raw.githubusercontent.com/docker/scout-cli/main/install.sh | sh
echo "$DOCKERHUB_TOKEN" | docker login -u "$DOCKERHUB_USERNAME" --password-stdin
docker scout cves myorg/api:1.4.2Treat a policy failure as a real finding
When the gate fails on CVEs, fix or accept the vulnerabilities rather than suppressing the check.
How to prevent it
- Install and pin the Scout CLI plugin on runner images.
- Authenticate to Docker before running Scout analysis.
- Decide deliberately whether Scout is advisory or a hard gate in CI.