Docker Scout version 1.18.2

There’s a quiet moment after every deploy where you ask yourself: what actually changed? Not just the feature—you know that—but the stuff beneath it. Packages. Base images. Vulnerabilities that slipped in while you were busy shipping. Docker Scout’s CLI gives you the flashlight for that dark room. No dashboards. No detours. Just commands, signal, and the truth.

In July 2025 I wrote a blogpost about Docker Scout for Vulnerability management of Containers and remediation

Docker Scout Compare is quite significant for container security, especially in modern DevSecOps workflows. Here’s why it matters:

What Docker Scout Compare Does

• Image Comparison: It analyzes two Docker images—typically a new build vs. a production version—and highlights differences in vulnerabilities, packages, and policies.
• Security Insights: It identifies newly introduced CVEs (Common Vulnerabilities and Exposures), changes in package versions, and policy violations between image versions.
• SBOM Integration: It uses Software Bill of Materials (SBOMs) to trace dependencies and match them against vulnerability databases.

Why It’s Important for Security

• Proactive Risk Management: By comparing images before deployment, teams can catch regressions or newly introduced vulnerabilities early.
• Supply Chain Transparency: Helps track changes across the container supply chain, which is crucial for preventing issues like Log4Shell.
• CI/CD Integration: Fits seamlessly into automated pipelines, ensuring every image update is vetted for security before release.

Key Features That Boost Its Value

Feature	Benefit
Continuous vulnerability scanning	Keeps your images secure over time, not just at build time
Filtering options	Focus on critical or fixable CVEs, ignore unchanged packages, etc.
Markdown/Text reports	Easy to integrate into documentation or dashboards
Multi-stage build analysis	Understand security across complex Dockerfiles

Bottom Line

If you’re serious about container security, Docker Scout Compare isn’t just helpful—it’s becoming essential. It gives developers and security teams a clear view of what’s changing and whether those changes introduce risk.

The heart of change: compare old vs new, precisely

You built a new image. What did you add? What did you remove? What got better—or worse?
Here are some Docker scout compare CLI commands:

# Compare prod vs new build

docker scout compare –to myapp:prod myapp:sha-123

# Focus on meaningful risk changes (ignore base image CVEs)

docker scout compare –to myapp:prod myapp:sha-123 –ignore-base

# Show only high/critical that are fixable

docker scout compare –to myapp:prod myapp:sha-123 –only-severity high,critical –only-fixed

# Fail when security gets worse (perfect for CI)

docker scout compare –to myapp:prod myapp:sha-123 –exit-on vulnerability

Here you find more about Docker Scout Compare

In my case I will do a Docker Scout compare between these two images:

docker scout compare –to azure-cli-patched:latest mcr.microsoft.com/azure-cli:azurelinux3.0

Compare results between the two images.

Compare results between the two images, here you see the Fixed vulnerability differences.

Conclusion

Final Thoughts: Docker Scout Compare CLI & Security

In today’s fast-paced development landscape, security can’t be an afterthought—it must be woven into every stage of the software lifecycle. Docker Scout Compare CLI empowers teams to do just that by offering a clear, actionable view of how container images evolve and what risks they may introduce. Its ability to pinpoint new vulnerabilities, track dependency changes, and integrate seamlessly into CI/CD pipelines makes it a vital tool for modern DevSecOps.

By embracing Docker Scout Compare, organizations move from reactive patching to proactive prevention—turning container security from a bottleneck into a strategic advantage.