# Vulnerability Scanning Changes **URL:** \ **Category:** Docker Hub\ **Tags:** dockersecurityscan\ **Created:** [February 25, 2023, 7:28pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829 "2023-02-25T19:28:14Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![garymoon](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@garymoon](https://forums.docker.com/u/garymoon)\ **Post date:** [February 25, 2023, 7:28pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/1 "2023-02-25T19:28:14Z")
Hi, Docker sent out an email recently about transitioning providers for vulnerability scanning. To say it was light on details would be an understatement. The “third party” it refers to is Snyk I assume? The “documentation” linked from the email doesn’t even appear to acknowledge the change, let alone provide any details. Vulnerability scanning is kind of a serious feature. The lack of information is this announcement leaves me little alternative than to assume this will effectively be a downgrade for users, and the lack of detail is intended to obscure that being the case. This communication (or rather lack thereof) is a stellar display of the ineptitude that makes it difficult to promote the use of Docker Hub in an organization without looking silly. Do better please Docker. Thank you. ---
**Author:** ![meyay](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/meyay/32/34000_2.png) [@meyay](https://forums.docker.com/u/meyay)\ **Post date:** [February 26, 2023, 10:27am UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/2 "2023-02-26T10:27:36Z")
I don’t recall having received such an email. Can you share the subject and date of the email? If I remember right, Dockerhub started using Synk somewhere around October 2020. So if you recently received an email about transitioning providers for vulnerability scanning, it would mean moving away from Snyk… The [docs](https://docs.docker.com/docker-hub/vulnerability-scanning/) still indicate that Synk is used. These type of changes are usually accompanied by announcement blog posts. Note: I am not a Docker employee. ---
**Author:** ![ajeetraina](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/ajeetraina/32/34719_2.png) [@ajeetraina](https://forums.docker.com/u/ajeetraina)\ **Post date:** [February 26, 2023, 10:43am UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/3 "2023-02-26T10:43:44Z")
Hi @garymoon I work as a part of DevRel Team at Docker. Would love to forward your message to the concerned team. I have DM’ed you via chat and would be great if you can forward me the email that you received. We are here to help you in case of any concern. ---
**Author:** ![garymoon](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@garymoon](https://forums.docker.com/u/garymoon)\ **Post date:** [February 26, 2023, 4:20pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/4 "2023-02-26T16:20:35Z")
Hi meyay and ajeetraina, Thanks for your responses. My apologies for not posting the original email, it didn’t occur to me that not everyone would be receiving it. I’ve attached a screenshot below. In addition to my previous points of frustration, I’ll note that I received the email at both my work and personal email addresses on the date of the transition (Feb 24), which is obviously absurd, and that the “view online” link at the top doesn’t work (I can’t post with more than one attachment, but [this is the link](https://web.docker.com/index.php/email/emailWebview?md_id=3565)). @ajeetraina I don’t seem to have any DMs. Please let me know if the screenshot isn’t sufficient and I’ll work on getting you a forwarded copy. Thanks, Gary. ![docker-vuln-scanning-email|100%](https://global.discourse-cdn.com/docker/original/3X/d/4/d458eed85c5276582e9551ac21a394e8c9f7104d.png) ---
**Author:** ![meyay](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/meyay/32/34000_2.png) [@meyay](https://forums.docker.com/u/meyay)\ **Post date:** [February 26, 2023, 5:05pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/5 "2023-02-26T17:05:00Z")
@garymoon, thanks to your post, I started to look at my daylie quarantine reports and found the mail. It indeed feels rushed, as ink in the email that points to the documentation do not reflect the change. The mention third-party must be Synk. The mail indicates that vulnerability scanning is now based on Atomist and not just scans the os-pakages, but also performs dependency scanning (I assume for package managers like maven/gradle, npm, nuget or others). I am surprised that I dind’t find a blog post announcing this change. ---
**Author:** ![garymoon](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@garymoon](https://forums.docker.com/u/garymoon)\ **Post date:** [February 26, 2023, 5:35pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/6 "2023-02-26T17:35:56Z")
> [@meyay](#): > > It indeed feels rushed “Rushed” implies we were notified some amount of time ahead of the change. This situation wouldn’t be acceptable for a _free_ security-oriented feature, let alone one we pay for. ---
**Author:** ![ajeetraina](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/ajeetraina/32/34719_2.png) [@ajeetraina](https://forums.docker.com/u/ajeetraina)\ **Post date:** [February 28, 2023, 3:49pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/7 "2023-02-28T15:49:34Z")
Hi @garymoon If you scroll down the recently uploaded Docker Scout page [https://www.docker.com/products/docker-scout/](https://www.docker.com/products/docker-scout/) page, you will find FAQ that clearly states: ## Will I still be able to use other security tools, such as Snyk, with Docker? Yes. Docker is committed to supporting developers and their favorite tools and will continue to offer flexible integration whenever possible. Some security tools provide [Docker Extensions](https://hub.docker.com/search?q=&type=extension) to make integration even easier. Hope that helps. Also, it is important to note that Docker is building Docker Scout to sit as a layer on top of the Docker ecosystem to help developers build and maintain a secure software supply chain. Right now, Docker is focussed on helping with vulnerability remediation; we think our CVE-to-package matching (using PURLs to help avoid false positives) and our SBOM-to-CVEdb matching (no need to rescan) are both nice improvements to the current Developer experience. ---
**Author:** ![garymoon](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@garymoon](https://forums.docker.com/u/garymoon)\ **Post date:** [February 28, 2023, 4:10pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/8 "2023-02-28T16:10:23Z")
Hi @ajeetraina, thanks for the update. Unfortunately, it’s still missing the point. Docker sent an email on a Friday, notifying users of a security-oriented change of that had already taken place, without sufficient detail to so much as determine _what_ was changing. Paying users were left to their own devices to figure out WTF was happening and how it impacted them. After some sleuthing it turns out Docker is replacing (or rather, had already replaced) a de-facto standard security tool (all references to which have now been scrubbed with “third-party”, which is just embarassing) with a similar offering from a recent acquisition. Not only was documentation not updated to reflect the replacement, let alone provide any detail about what might change, but there is also no standalone doc material on the replacement tool. The best Docker can apparently offer after the fact is a link to documentation for a feature I’ve never heard of indicating that I can do what I used to pay Docker to do for me myself. Fan-freakin-tastic. It’s now been 5 days since the change was made known to me, and I still have no idea how it impacts me. I’ve worked in this industry for almost twenty years, for companies both much larger and much smaller than Docker, and I cannot even begin to fathom how they managed to bungle this so completely 🤦‍♂️ ---
**Author:** ![rimelek](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/rimelek/32/41602_2.png) [@rimelek](https://forums.docker.com/u/rimelek)\ **Post date:** [February 28, 2023, 10:36pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/9 "2023-02-28T22:36:17Z")
I think I understand your point. I don’t know the reason why it was handled like this and I will not attempt to figure it out. Docker could have a reason which we might never know. All I can do is trying to give you more information based on what I know. I know that there was a blog post about the acquisition of Atomist last year: > **[Securing the Software Supply Chain: Atomist Joins Docker | Docker](https://www.docker.com/blog/docker-acquires-atomist/)** > > Learn from Docker experts to simplify and advance your app development and management with Docker. Stay up to date on Docker events and new version but it didn’t mention replacing Snyk. When I first saw your post days ago and searched for Atomist, I could also find it in the documentation of Docker. I can still find the following URLs in my browser history: ```auto https://docs.docker.com/atomist/ https://www.docker.com/products/atomist/ ``` Now the first redirects to [https://docs.docker.com/scout/](https://docs.docker.com/scout/) and the second is to [https://www.docker.com/products/docker-scout/](https://www.docker.com/products/docker-scout/) So it was renamed since then, but it still must be atomist possibly changed, integrated more into Docker’s ecosystem. > [@garymoon](#): > > feature I’ve never heard of To be honest I have never heard of Atomist before either. I must have missed the blog post too at that time, so I can understand what you feel. On the other hand, I don’t think it would be a downgrade in Docker Hub as you mentioned in your first post. The whole story of my presence here on `forums.docker.com` started with the need of trying the vulnerability scanning about one and a half years ago. I think I was not sure what was behind the GUI or at least didn’t care. I believe Docker would not downgrade an existing and important feature (unless there is no other way for some reason) as it would affect many users. So I guess you will still get the same features. The question is how good Atomist (Docker Scout) will be at scanning compared to Snyk and I am sure this is why you think understandably that it should have been ccommunicated better so yo can make your decision whether you trust in it or not as you probably knew Snyk before started to pay for Docker Hub’s vulnerability scanning. At this point we can only test Docker Scout, make a decision now and hope future changes will be made with better communication. Since I have a PRO account and for me it does not really matter what is resposible for the vulnerability scanning, I will definitely keep it. In your case, can you share what you expect from Docker Hub’s vulnerability scanning and what you would consider a “downgrade”? If you can share that Someone from Docker or anyone who has an answer could try to help you make your decision. ---
**Author:** ![garymoon](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@garymoon](https://forums.docker.com/u/garymoon)\ **Post date:** [March 16, 2023, 2:40pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/10 "2023-03-16T14:40:44Z")
Thanks for your reply rimelek, sorry I missed it. To be clear, I’m already a paying customer, having recommended Docker Hub to my employer, and Docker’s complete ignorance of how to interact with customers is now egg on my face. > In your case, can you share what you expect from Docker Hub’s vulnerability scanning and what you would consider a “downgrade”? If you can share that Someone from Docker or anyone who has an answer could try to help you make your decision. I think we might still be missing the point. A paid Docker subscription should be **subtracting** from the time I have to spend thinking about Docker. I’ll add some emphasis to a quote block of yours below to illustrate my point. Note that this is in no way a criticism of you or your words, but rather a criticism of Docker for leaving so much uncertainty around…everything. > On the other hand, I don’t **think** it would be a downgrade in Docker Hub as you mentioned in your first post. The whole story of my presence here on `forums.docker.com` started with the need of trying the vulnerability scanning about one and a half years ago. I think I was not sure what was behind the GUI or at least didn’t care. I **believe** Docker would not downgrade an existing and important feature ( **unless there is no other way for some reason** ) as **it would affect many users**. So **I guess** you will still get the same features. **The question is how good Atomist (Docker Scout) will be at scanning** compared to Snyk and I am sure this is why you think understandably that it should have been ccommunicated better so yo can make your decision whether you trust in it or not as you probably knew Snyk before started to pay for Docker Hub’s vulnerability scanning. We just…don’t know anything 🤷‍♂️ ---
**Author:** ![garymoon](https://avatars.discourse-cdn.com/v4/letter/g/ea666f/32.png) [@garymoon](https://forums.docker.com/u/garymoon)\ **Post date:** [March 16, 2023, 2:49pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/11 "2023-03-16T14:49:25Z")
The reason I popped over today was because I saved [this](https://news.ycombinator.com/item?id=35154025) thread from HN a couple of days ago. At least these poor people got some notice I guess? I’ll post the first couple top-level comments below. It’s a relief to find I’m far from the only one utterly perplexed by Docker’s inability to communicate. #1 > Whats phenomenal about this so far is that the email does not indicate: > > ```auto > - what actually will happen to teams that don't become paid > - what will get deleted on which timeline > - whether others will be able to typosquat the images after the teams get deleted > - how folks might handle cases where a team is owned by an oss org and has no central billing thing (fairly common) > - how we might better handle bot users as part of paid teams > > ``` > > Also great is that the only way I’d know this was going on is by checking my email - I quickly went to their blog to look and didn’t find anything relating to this email. > > If anything, I’d want to convert my teams (dokku and gliderlabs) _back_ to single accounts, but there doesn’t seem to be a way to do that. > > I get that there is a need to make the company profitable but maybe spend more than 5 minutes crafting the email and thinking of outcomes for your users (who are already pissed at your pricing changes). This only makes me feel like I should move my hosting to something paid (ECR?), delete the org, and then typosquat the images. #2 > Utterly confusing messaging from Docker once again, and this is from a prior advocate for early Docker, and part of their Captains program for several years. > > The wording seems clear that they are going to delete all data and lock access unless payment is received within 30 days, whether there are public or private repos in the organisation. > > I pay for a personal account, however my main concern is people taking over the official account names and publishing poison images which people are used to pulling already, and won’t even think to check if the account ownership has changed. > > I’ve asked the CTO to comment on Twitter. > > [https://twitter.com/alexellisuk/status/1635679295891812359?s…](https://twitter.com/alexellisuk/status/1635679295891812359?s=20) (Naturally there appears to be no reply on Twitter.) #3 > Docker: We’re making 100 million/year in revenue and everyone is treating us as the trusted place to work with docker images–we’re a huge success! > > “For our next act, let’s hold their images hostage and threaten to kill them in 30 days unless they pay a ransom!” > > I mean, it’s ok to hate your users, but maybe just don’t make it so obvious? People who work in comms/marketing/c-level at Docker: ![image](https://global.discourse-cdn.com/docker/original/3X/8/8/888d14c38518c877bcefa2dbe0fff464c7d0dc95.jpeg) ---
**Author:** ![rimelek](https://sea3.discourse-cdn.com/docker/user_avatar/forums.docker.com/rimelek/32/41602_2.png) [@rimelek](https://forums.docker.com/u/rimelek)\ **Post date:** [March 16, 2023, 10:53pm UTC](https://forums.docker.com/t/vulnerability-scanning-changes/134829/12 "2023-03-16T22:53:54Z")
> [@garymoon](#): > > The reason I popped over today was because I saved [this](https://news.ycombinator.com/item?id=35154025) thread from HN a couple of days ago. If it matters, Docker is learning > [@Docker team organization sunsetting](https://forums.docker.com/t/docker-team-organization-sunsetting/135089/9): > > I think we have an official response slight_smile > [@garymoon](#): > > I think we might still be missing the point. A paid Docker subscription should be **subtracting** from the time I have to spend thinking about Docker. I understood you, but this is a community forum and I am a community member, so I am thinking as such 🙂 and trying to learn from your opinions which might point out something that would affect others, maybe even me so I can do some research to find out if it will happen. You can see from my words that you emphasized that “I believe”, but I may be wrong. Docker could have released the initial scanning feature without telling us what is behind it (let’s imagine the contract would have allowed it) and change it later. From my point of view the most important thing is to get the same feature. If I get that, I don’t care what is behind it. Snyk has a well-known name and we knew very well that it was behind the vulnerability scanning and this is what changes how we judge the change of the feature. If Snyk changes anything in its own product, the most of us probably think it is an improvement. So I get that it was not communicated well, but we can’t change that. We can only ask for more information and clarification which you did here! And all I can do is offer my help to get more, but it is easier if I have a specific question to ask or search for. Of course I understand if you dont want to “think more about Docker” on your busy days. In that case, I just which you have a nice day and thank you for sharing your opinion and questions in a civilized way!