scout-cli icon indicating copy to clipboard operation
scout-cli copied to clipboard

`recommendations` suggests non-LTS image

Open rcjsuen opened this issue 6 months ago • 3 comments

I assume that this can probably reproduced for other images like node and so on that uses different numbering schemes for LTS vs unstable.

FROM ubuntu:24.10
RUN ls
$ docker buildx build --provenance=true --no-cache -t rcjsuen:latest .
[+] Building 6.9s (6/6) FINISHED                                                                                                                                                                                                                 docker:desktop-linux
 => [internal] load build definition from Dockerfile                                                                                                                                                                                                             0.0s
 => => transferring dockerfile: 99B                                                                                                                                                                                                                              0.0s
 => [internal] load metadata for docker.io/library/ubuntu:24.10                                                                                                                                                                                                  6.6s
 => [internal] load .dockerignore                                                                                                                                                                                                                                0.0s
 => => transferring context: 2B                                                                                                                                                                                                                                  0.0s
 => CACHED [1/2] FROM docker.io/library/ubuntu:24.10@sha256:aadf9a3f5eda81295050d13dabe851b26a67597e424a908f25a63f589dfed48f                                                                                                                                     0.0s
 => => resolve docker.io/library/ubuntu:24.10@sha256:aadf9a3f5eda81295050d13dabe851b26a67597e424a908f25a63f589dfed48f                                                                                                                                            0.0s
 => [2/2] RUN ls                                                                                                                                                                                                                                                 0.1s
 => exporting to image                                                                                                                                                                                                                                           0.1s
 => => exporting layers                                                                                                                                                                                                                                          0.0s
 => => exporting manifest sha256:854b27b3779fdabd3d2f45c1eb01c94d34ae179e24af17ac05c15f19e9c56d11                                                                                                                                                                0.0s
 => => exporting config sha256:a3b12de1e3665b9c135b79a76260c930c7a020fd36cfa46cc67b870e6185e6e0                                                                                                                                                                  0.0s
 => => exporting attestation manifest sha256:2a65288e36ffb351b4c2a494678efd086d49c460ca7521b0c9988625e6e121e3                                                                                                                                                    0.0s
 => => exporting manifest list sha256:9054544c0f6d3967c4dc22a5122bd9737a7b1adc894acde6c873fdf6ff5b3955                                                                                                                                                           0.0s
 => => naming to docker.io/library/rcjsuen:latest                                                                                                                                                                                                                0.0s
 => => unpacking to docker.io/library/rcjsuen:latest                                                                                                                                                                                                             0.0s

View build details: docker-desktop://dashboard/build/desktop-linux/desktop-linux/xkwr7aezbrd8sixw1dsdhe475

What's next:
    View a summary of image vulnerabilities and recommendations → docker scout quickview
$ docker scout recommendations rcjsuen:latest
    ✓ Image stored for indexing
    ✓ Indexed 132 packages
    ✓ Provenance obtained from attestation
    ✓ Pulled

  Target   │  rcjsuen:latest
    digest │  9054544c0f6d

## Recommended fixes

  Base image is  ubuntu:24.10

  Name            │  24.10
  Digest          │  sha256:83edc2b2f3ec4149c8ee6e67d0f53d9bb360a5b17395ab87f0a93fc0a266b218
  Vulnerabilities │    0C     0H     5M     6L
  Pushed          │ 1 month ago
  Size            │ 30 MB
  Packages        │ 132
  OS              │ 24.10


Refresh base image
  Rebuild the image using a newer base image version. Updating this may result in breaking changes.

  ✓ This image version is up to date.


Change base image
  The list displays new recommended tags in descending order, where the top results are rated as most suitable.


            Tag           │                        Details                        │   Pushed    │       Vulnerabilities
──────────────────────────┼───────────────────────────────────────────────────────┼─────────────┼──────────────────────────────
   25.04                  │ Benefits:                                             │ 3 weeks ago │    0C     0H     3M     5L
  Major OS version update │ • Image is smaller by 2.0 MB                          │             │                  -2     -1
  Also known as:          │ • Image contains 10 fewer packages                    │             │
  • plucky                │ • Tag was pushed more recently                        │             │
  • rolling               │ • Image introduces no new vulnerability but removes 3 │             │
  • plucky-20250415       │ • Major OS version update                             │             │
                          │                                                       │             │
                          │ Image details:                                        │             │
                          │ • Size: 28 MB                                         │             │
                          │ • OS: 25.04                                           │             │
                          │                                                       │             │
                          │                                                       │             │
                          │                                                       │             │

rcjsuen avatar May 08 '25 15:05 rcjsuen