Docker Scout: Policy Weights, Evaluation, Repository Scores, and Improving Health Scores

Images can also be assigned an `N/A` score, which can happen when: - The image is larger than 4GB (compressed size). - The image architecture is not `linux/amd64` or `linux/arm64`. - The image is too old and does not have fresh data for evaluation. If you see an `N/A` score, consider the following: - If the image is too large, try reducing the size of the image. - If the image has an unsupported architecture, rebuild the image for a supported architecture. - If the image is too old, push a new tag to trigger a fresh evaluation. ### Policy weights Different policy types carry varying weights, which impact the score assigned to an image during evaluation, as shown in the following table. | Policy type | Points | | -------------------------------------------------------------------------------------------- | ------ | | [Severity-Based Vulnerability](/manuals/scout/policy/_index.md#severity-based-vulnerability) | 20 | | [High-Profile Vulnerabilities](/manuals/scout/policy/_index.md#high-profile-vulnerabilities) | 20 | | [Supply Chain Attestations](/manuals/scout/policy/_index.md#supply-chain-attestations) | 15 | | [Approved Base Images](/manuals/scout/policy/_index.md#approved-base-images) | 15 | | [Up-to-Date Base Images](/manuals/scout/policy/_index.md#up-to-date-base-images) | 10 | | [SonarQube Quality Gates](/manuals/scout/policy/_index.md#sonarqube-quality-gates) \* | 10 | | [Default Non-Root User](/manuals/scout/policy/_index.md#default-non-root-user) | 5 | | [Compliant Licenses](/manuals/scout/policy/_index.md#compliant-licenses) | 5 | \* _This policy is not enabled by default and must be configured by the user._ ### Evaluation Health scores are calculated for new images pushed to Docker Hub after the feature is enabled. The health scores help you maintain high security standards and ensure your applications are built on secure and reliable images. ### Repository scores In addition to individual image scores (per tag or digest), each repository receives a health score based on the latest pushed tag, providing an overall view of the repository's security status. ### Example For an image with a total possible score of 100 points: - If the image only deviates from one policy, worth 5 points, its score will be 95 out of 100. Since this score is above the 90th percentile, the image receives an A health score. - If the image is non-compliant with more policies and scores 65 out of 100, it receives a C health score, reflecting its lower compliance. ## Improving your health score To improve the health score of an image, take steps to ensure that the image is compliant with the Docker Scout recommended [policies](./_index.md). 1. Go to the [Docker Scout Dashboard](https://scout.docker.com/). 2. Sign in using your Docker ID. 3. Go to [Repository settings](https://scout.docker.com/settings/repos) and enable Docker Scout for your Docker Hub image repositories. 4. Analyze the [policy compliance](./_index.md) for your repositories, and take actions to ensure your images are policy-compliant. Since policies are weighted differently, prioritize the policies with the highest scores for a greater impact on your image's overall score.

Docker Scout assigns different weights to policy types impacting the score, as detailed in a table. Health scores are calculated for new Docker Hub images after feature enablement, helping maintain security standards. Repositories also receive an overall health score based on the latest pushed tag. Improving health scores involves ensuring compliance with Docker Scout's recommended policies, prioritizing those with higher weights. The process includes enabling Docker Scout in repository settings and analyzing policy compliance.