Skip to main content

Integrate Docker Hub

Container Registry Support​

Docker Hub integrations support:

  • Auto polling - polling occurs every 15 minutes
  • On-demand scans via the API
  • Only v2 format is supported
  1. Log in to the Lacework Console with an account with admin permissions.
  2. Navigate to Settings > Integrations > Container registries.
  3. Click + Add New.
  4. Click Docker Hub.
  5. Click Next.
  6. Follow the steps in the next section.

Integrate with Docker Hub​

To integrate Docker Hub with Lacework, follow these steps:

  1. Configure the registry and complete any optional settings.
  2. Click Save. The integration status displays Integration Successful only after its first assessment completes.
  3. Verify that assessments have started by viewing the table in Vulnerabilities > Containers.

After an image is assessed, Lacework reports its results in the table. Select Last 24 hours above the table to view the assessment results.

Configure Registry​

Setting NameDescription
NameSpecify a unique name for the container registry in the Lacework Console.
User NameSpecify a Docker user that has at least read-only permissions to the Docker Hub container repositories that you want to assess for vulnerabilities. NOTE: This must be in username format and not your email address.

Docker uses organizations and teams to grant permissions. The following example explains how to grant permissions in Docker:
1) Create a Docker organization called MyCompany and in that organization create a team called MyGroup.
2) Add the user to the MyGroup team.
3) For all the repositories that have container images that you want to assess for vulnerabilities give at least read-only permissions to the MyGroup team.

For more information, see the following topics in the Docker documentation: Create and manage organizations, Create and manage users, and Create and manage teams in https://docs.docker.com/.
PasswordSpecify the password for the specified Docker Hub user. Alternatively, you can use personal access tokens to access Hub images from the Docker CLI. For details, see Managing Access Tokens.
Registry DomainThis field is prepopulated with the URL of Docker Hub, index.docker.io.

Optional Settings​

Setting NameDescription
Limit Image TagsIf you do not want to assess all images in this registry, specify text from an image tag so that only images with matching tag text will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. You can input multiple tags. If you specify tag and label limits, they function as an AND.

Single wildcards are also supported and can be used to match multiple image tags (for example: abc* or *xyz).
Limit Image LabelsIf you do not want to assess all images in this registry, specify key:value pairs so that only images with matching label key:value pairs will be assessed. To change which images you want to assess, update this field so the change is captured during the next polling period. Supported field input: key:value. If you specify tag and label limits, they function as an AND.
Limit RepositoriesIf you do not want to discover/assess all repositories in this registry, specify a comma-separated list of repositories to discover/assess (without spaces recommended). To change which repositories you want to assess, update this field so the change is captured during the next polling period.

NOTE: Do not include the registry in the repository name(s).
Images per RepoSet the maximum number of newest container images to discover/scan per repository. See Platform Scanner - Default Scanning Quotas for the maximum setting.
Non-OS Package SupportThis feature is enabled by default. Select No if you want to disable scanning of language libraries.
Last updated on