dhi: add malware scan info#24729
Conversation
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
craig-osterhout
added
status/review
|
/review |
✅ Deploy Preview for docsdocker ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
![docker-agent[bot]](https://avatars.githubusercontent.com/in/2787757?s=60&v=4){kind=small}
There was a problem hiding this comment.
Assessment: 🟢 APPROVE
This PR adds comprehensive documentation for malware scanning in Docker Hardened Images. The changes are well-structured and follow the Docker documentation style guide.
What was reviewed:
- New file:
malware-scanning.md- Documents ClamAV-based virus scanning with clear examples - Updated:
attestations.md- Added cross-references to the new malware scanning topic - Updated:
build-process.md- Integrated scanning into the build pipeline diagrams - Updated:
_index.md- Added navigation entry for the new topic
Quality checks passed:
✅ No AI-generated patterns (hedge words, meta-commentary, marketing speak)
✅ Proper front matter with all required fields
✅ Valid cross-references and links
✅ Correct goat diagram syntax
✅ Follows Docker documentation style guide
✅ Clear, concise, and technically accurate content
✅ Good use of callouts and code examples
The documentation is ready to merge.
Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
| description: How to interact with the DHI team | ||
| keywords: software supply chain security, feedback, bugs, discussion, questions | ||
| weight: 50 | ||
| weight: 999 |
There was a problem hiding this comment.
you can also unset weight to let it sink to the bottom - pages with any weight are always ranked higher than weightless pages.
3 participants
Description
Summary
Details
DHI images include a signed virus/malware scan attestation (
https://scout.docker.com/virus/v0.1), but this wasn't documented anywhere beyond a one-line mention in the attestations table. This PR adds a dedicated Explore topic for it and integrates scanning into the build pipeline documentation.The attestation content was verified by pulling actual attestations from both a base image (
dhi.io/python:3.13) and a customized image (projectsteam/dhi-python-3:3.10-alpine3.22_curl). Key findings that informed the docs:clamav/clamav:stable), scanning all OCI blobs including archivesNotable generated topics
Related issues or tickets
Closes #24728
Reviews