Meta tags:
description=Create an exception for a vulnerability in an image using VEX documents.;
keywords=Docker,vulnerability,exception,create,VEX;

Headings (most frequently used words):

vex, to, example, documents, create, an, exception, using, the, prerequisites, introduction, vexctl, json, document, verifying, attach, images, what, can, help, you, with, attestation, image, filesystem,

Text of the page (most frequently used words):
the (210), docker (103), image (82), vex (67), and (64), for (42), use (31), driver (31), engine (30), with (28), build (27), #document (26), you (25), create (24), images (23), swarm (23), documents (22), scout (22), example (21), status (18), vulnerability (18), manage (18), this (17), are (17), your (17), how (16), openvex (16), that (15), attestations (15), cli (15), compose (15), file (14), can (14), using (14), security (14), release (14), logging (14), product (13), filesystem (13), attestation (13), exceptions (13), storage (13), copying (12), cve (11), desktop (11), faqs (11), notes (11), cache (11), settings (10), attach (10), command (10), registry (10), purl (10), access (10), container (10), usage (10), service (9), json (9), from (9), pkg (9), configure (9), network (9), v17 (9), vexctl (8), true (8), false (8), exception (8), version (8), repository (8), package (8), multiple (8), troubleshoot (8), extension (8), mode (8), copy (7), not (7), location (7), add (7), new (7), results (7), specification (7), justification (7), author (7), statements (7), not_affected (7), local (7), npm (7), affected (7), containers (7), plugin (7), management (7), reference (7), deploy (7), support (7), feedback (7), variables (7), content (7), started (7), trust (7), v18 (7), daemon (7), all (6), about (6), introduction (6), must (6), builds (6), store (6), settimeout (6), 2000 (6), provenance (6), change (6), push (6), account (6), more (6), github (6), format (6), subcomponents (6), information (6), software (6), migrate (6), logs (6), quickstart (6), configuration (6), get (6), bake (6), drivers (6), multi (5), where (5), dockerfile (5), following (5), when (5), these (5), name (5), output (5), cves (5), install (5), possible (5), app (5), statement (5), labels (5), code (5), core (5), open (5), tos (5), hardened (5), setup (5), subscription (5), best (5), practices (5), extensions (5), data (5), environment (5), examples (5), gordon (5), model (5), plugins (5), start (5), note (4), part (4), context (4), sbom (4), building (4), update (4), type (4), options (4), dev (4), describes (4), analysis (4), whether (4), vulnerable_code_not_in_execute_path (4), express (4), products (4), 2022 (4), 24999 (4), docs (4), tags (4), implementation (4), key (4), actions (4), billing (4), platform (4), features (4), integration (4), guides (4), marketplace (4), integrations (4), metrics (4), beta (4), networking (4), concepts (4), customize (4), migration (4), overview (4), agent (4), mcp (4), profiles (4), secrets (4), exporters (4), remote (4), nodes (4), thread (4), verifying (3), prerequisites (3), files (3), stage (3), filename (3), syntax (3), into (3), under (3), embedded (3), remove (3), added (3), have (3), has (3), will (3), look (3), there (3), https (3), been (3), need (3), specify (3), out (3), include (3), flag (3), test (3), tool (3), label (3), why (3), values (3), see (3), between (3), documentation (3), work (3), vuln (3), also (3), defined (3), run (3), known (3), remediate (3), impact (3), vulnerabilities (3), standard (3), permissions (3), containerd (3), dashboard (3), gui (3), user (3), organization (3), claude (3), manuals (3), advanced (3), custom (3), roles (3), sign (3), general (3), insights (3), set (3), authentication (3), accounts (3), deprecated (3), cloud (3), api (3), continuous (3), sdk (3), binaries (3), kubernetes (3), architecture (3), publish (3), share (3), source (3), azure (3), amazon (3), registries (3), policy (3), explore (3), optimize (3), export (3), search (3), hub (3), give (3), windows (3), mac (3), gpu (3), debian (3), ubuntu (3), chart (3), experimental (3), dmr (3), troubleshooting (3), toolkit (3), services (3), buildkit (3), functions (3), contexts (3), log (3), llms (2), full (2), txt (2), table (2), contents (2), page (2), final (2), doesn (2), var (2), lib (2), alpine (2), embed (2), automatically (2), flags (2), only (2), any (2), later (2), layers (2), immutable (2), attaching (2), provides (2), better (2), directly (2), option (2), time (2), before (2), easy (2), just (2), predicate (2), tag (2), again (2), attached (2), inspect (2), recommended (2), once (2), but (2), ways (2), other (2), fields (2), way (2), invalid (2), separated (2), named (2), myapp (2), begin (2), followed (2), filtered (2), specified (2), current (2), working (2), well (2), formed (2), apply (2), learn (2), available (2), refer (2), bit (2), details (2), 2024 (2), 27t13 (2), timestamp (2), com (2), public (2), here (2), generated (2), case (2), given (2), executed (2), definitions (2), justifications (2), one (2), statuses (2), creating (2), fixed (2), vulnerable (2), exists (2), identifier (2), entire (2), same (2), packages (2), lets (2), single (2), description (2), describe (2), describing (2), advisory (2), specific (2), supports (2), regardless (2), provide (2), versions (2), remediation (2), group (2), states (2), infrastructure (2), exploitability (2), assessments (2), enabled (2), interface (2), markdown (2), tokens (2), namespace (2), enable (2), isolation (2), enforce (2), provision (2), mapping (2), providers (2), domains (2), installer (2), deactivate (2), enterprise (2), scale (2), two (2), history (2), lifecycle (2), testcontainers (2), backend (2), developer (2), tools (2), socket (2), host (2), design (2), metadata (2), arch (2), process (2), non (2), environments (2), quality (2), view (2), evaluate (2), policies (2), collection (2), artifact (2), types (2), sboms (2), delete (2), repositories (2), program (2), trusted (2), automated (2), mirror (2), library (2), builder (2), uninstall (2), releases (2), linux (2), restore (2), wsl (2), capabilities (2), resource (2), volumes (2), rhel (2), fedora (2), permission (2), requirements (2), resources (2), slsa (2), select (2), verify (2), node (2), testing (2), models (2), engines (2), runner (2), templates (2), agents (2), sandboxes (2), server (2), catalog (2), bridge (2), oci (2), legacy (2), works (2), opentelemetry (2), debugging (2), annotations (2), validation (2), workflow (2), checks (2), targets (2), builders (2), device (2), v26 (2), protect (2), running (2), certificates (2), proxy (2), mounts (2), answers (2), questions (2), helpful (2), assistant (2), copyright, 2013, 2026, inc, rights, reserved, legal, terms, cookies, pricing, offerings, request, changes, edit, copied, persist, match, glob, pattern, matter, shows, want, may, ensure, explicitly, disable, both, considered, downside, approach, anything, put, forever, flexibility, embedding, good, know, ahead, relatively, toto, predicatetype, already, pushed, don, additionally, having, means, consumers, doing, overwrite, previous, won, rebuild, created, specifying, incorrect, make, sure, comply, impact_statement, remember, mandatory, field, things, displays, found, factored, assigned, seem, take, indication, might, some, invokes, incorporates, instructed, directory, produce, expected, understanding, supposed, structured, mouthful, properties, 395829, 395824, 749f79b50f5f2f0f07747c2de9f1239b37c2bda663579f87a35e5f0fdfc13de5, justifies, informing, signalling, used, their, inline_mitigations_already_exist, vulnerable_code_cannot_be_controlled_by_adversary, vulnerable_code_not_present, component_not_present, five, relationship, asserts, suppression, useful, purposes, they, under_investigation, addresses, omit, which, applies, times, url, standardized, strings, prefix, sha256, digest, unlike, like, email, unaffected, because, never, contains, described, creates, stating, mitigate, action, depending, isn, exploitable, issue, storing, depends, implementations, formats, idea, framework, components, includes, investigation, yet, provided, contain, fix, address, required, regarding, united, cybersecurity, agency, cisa, write, stored, line, latest, friendly, exchange, documenting, ask, home, air, gapped, reporting, admin, console, limitations, eci, enhanced, auto, scim, identity, enforcement, connections, microsoft, box, jamf, pro, intune, msi, activity, users, owners, organizations, company, teams, members, convert, onboard, administration, license, agreement, seats, compare, announcements, recover, factor, personal, submit, tax, exemption, certificate, cycle, invoices, secure, payment, method, navigation, apis, debug, invoke, interacting, mui, principles, guidelines, styling, validate, frontend, simple, private, slack, team, collaboration, sysdig, generic, integrating, jenkins, gitlab, circle, devops, pipelines, artifactory, ecr, sonarqube, compliance, health, scores, evaluation, database, sources, matching, deep, dive, different, exporter, pulls, limits, archive, analytics, sponsored, verified, publisher, official, autobuilds, tests, link, webhooks, bulk, move, artifacts, catalogs, optimization, offload, macos, damaged, dialog, issues, common, topics, diagnose, backup, maintenance, kernels, virtual, machine, manager, wasm, workloads, synchronized, shares, usb, pause, saver, allowlist, vdi, additional, stig, ssdlc, supply, chain, immutability, digests, hardening, glibc, musl, fips, distroless, signing, cis, benchmark, dhi, scan, helm, python, wolfi, assisted, checklist, malware, scanning, responsibility, scanner, privacy, cases, inference, webui, ide, rest, faq, workspace, credentials, defaults, kits, shell, opencode, kiro, gemini, droid, cursor, copilot, codex, early, e2b, gateway, dynamic, discovery, evals, rag, toolsets, acp, a2a, sharing, coding, provider, applications, production, extend, merge, watch, dependent, interpolation, pre, precedence, control, startup, order, hooks, project, standalone, development, buildkitd, toml, tar, built, input, git, validating, jobs, reproducible, summary, inline, blob, backends, garbage, invalidation, definition, overriding, configurations, matrix, expressions, inheritance, base, cdi, prior, v19, v20, v23, v24, v25, v27, v28, v29, config, volume, authorization, routing, mesh, configs, raft, consensus, networks, sensitive, lock, its, encryption, join, task, pki, drain, rolling, updates, getting, stack, administer, maintain, client, seccomp, isolate, events, play, sandbox, keys, notary, delegations, automation, apparmor, antivirus, tips, rootless, syslog, splunk, journald, graylog, extended, google, fluentd, etw, cloudwatch, prune, unused, objects, object, read, collect, prometheus, alternative, runtimes, live, ipv6, filter, commands, completion, runtime, constraints, processes, links, overlay, none, macvlan, ipvlan, port, publishing, packet, filtering, firewalls, nftables, iptables, zfs, windowsfilter, vfs, overlayfs, mapper, btrfs, tmpfs, bind, post, installation, steps, centos, raspberry, armhf, back, based, considers, viewing, relevant, reached, maximum, per, answer, remaining, quite, was, org, try, asking, what, help, chat,

Text of the page (random words):
e collection cache storage backends amazon s3 cache azure blob storage cache github actions cache inline cache local cache registry cache optimize cache usage in builds ci github actions annotations attestations build checks build secrets build summary buildkit configuration cache management copy image between registries export to docker github builder new architecture build workflow bake workflow local registry multi platform image named contexts push to multiple registries reproducible builds share image between jobs tags and labels test before push update docker hub description validating builds experimental introduction usage image validation git validation templates examples testing debugging input reference built in functions metadata annotations build attestations image attestation storage provenance attestations sbom attestations slsa definitions exporters image and registry exporters local and tar exporters oci and docker exporters buildkit buildkitd toml configure buildkit custom dockerfile syntax dockerfile release notes debugging opentelemetry support build release notes docker compose introduction to compose how compose works why use compose history and development install plugin standalone legacy uninstall quickstart how tos specify a project name use lifecycle hooks use service profiles control startup order use environment variables set environment variables environment variables precedence pre defined environment variables interpolation best practices build dependent images use compose watch secrets in compose networking use multiple compose files merge extend include enable gpu support use compose in production oci artifact applications use provider services compose bridge usage customize use model runner compose sdk new trust model for compose files support and feedback faqs give feedback release notes testcontainers docker agent experimental model providers local models building a coding agent best practices sharing agents integrations a2a acp mcp reference configuration file toolsets cli examples rag evals ai overview mcp catalog and toolkit beta get started catalog profiles toolkit ui use with cli dynamic discovery gateway hub mcp server faqs e2b sandboxes docker sandboxes early access get started usage agents claude code codex copilot cursor droid gemini kiro opencode docker agent shell customize templates kits examples build an agent architecture security model isolation layers defaults credentials policies workspace trust troubleshooting faq model runner get started with dmr dmr rest api configuration options dmr examples ide and tool integrations open webui integration inference engines gordon beta use cases concepts capabilities data privacy how to guides docker desktop cli permissions configure tools ai and docker compose use ai models in compose products docker hardened images new quickstart features explore hardened images build process image types scanner integrations image testing responsibility overview malware scanning feedback migration migration checklist ai assisted migration experimental migrate from alpine or debian migrate from ubuntu migrate from wolfi migration examples go python node js how tos search and evaluate mirror a repository customize an image or chart create and build an image use an image use a helm chart use hardened packages verify an image or chart scan an image enforce image usage use the cli use dhi select enterprise core concepts attestations cis benchmark code signing cves distroless images fips glibc and musl hardening image digests image provenance immutability sboms slsa software supply chain security ssdlc stig vex troubleshoot additional resources docker desktop setup install mac mac permission requirements windows windows permission requirements linux ubuntu debian fedora arch rhel vm or vdi environments sign in allowlist explore docker desktop containers images volumes builds kubernetes logs beta resource saver mode pause docker desktop features and capabilities networking how tos gpu support usb ip support synchronized file shares containerd image store wasm workloads beta docker desktop cli virtual machine manager wsl best practices custom kernels use wsl settings and maintenance change settings backup and restore data troubleshoot and support troubleshoot and diagnose common topics known issues macos app damaged dialog faqs general mac windows linux releases give feedback uninstall release notes docker offload quickstart about configure usage optimize usage troubleshoot give feedback docker build cloud setup usage continuous integration optimization builder settings release notes docker hub quickstart library search trusted content catalogs mirror repositories create manage repository information access images tags immutable tags image management software artifacts push images move images bulk migrate images image security insights webhooks automated builds set up link accounts automated repository tests advanced options migrate manage autobuilds troubleshoot trusted content docker official images docker verified publisher program docker sponsored open source program insights and analytics export repositories archive delete settings usage and limits pulls optimize usage troubleshoot release notes docker scout install quickstart explore dashboard docker scout image analysis docker scout metrics exporter image details view manage vulnerability exceptions how tos create an exception using the gui create an exception using the vex docker scout environment variables docker scout sboms use scout with different artifact types deep dive advisory database sources and matching service data collection and storage in docker scout policy evaluation configure policies docker scout health scores evaluate policy compliance in ci remediation with docker scout view docker scout policy status integrations code quality sonarqube container registries amazon ecr artifactory container registry azure container registry continuous integration azure devops pipelines circle ci github actions gitlab ci cd jenkins integrating docker scout with environments generic cli sysdig source code management github team collaboration slack release notes cli release notes platform release notes docker extensions marketplace extensions non marketplace extensions configure a private marketplace settings and feedback extensions sdk the build and publish process quickstart part one build create a simple extension create an advanced frontend extension add a backend to your extension part two publish add labels validate package and release your extension share your extension publish in the marketplace build multi arch extensions architecture metadata security design and ui styling guidelines docker design principles mui best practices developer guides authentication interacting with kubernetes invoke host binaries use the docker socket developer sdk tools test and debug continuous integration ci cli reference extension apis dashboard docker extension backend extension ui api navigation testcontainers cloud deprecated products and features release lifecycle platform support billing add or update a payment method manage your billing information 3d secure authentication invoices and billing history change your billing cycle submit a tax exemption certificate faqs docker accounts accounts create an account manage an account deactivate an account security personal access tokens two factor authentication recover your docker account faqs general container network and vm security announcements subscription compare subscription set up your subscription scale your subscription manage seats change your subscription docker desktop license agreement faqs release notes enterprise administration organization setup create onboard change information convert account manage members teams docker products deactivate faqs company create manage organizations owners users faqs activity logs insights deploy docker desktop msi installer pkg installer ms store deploy with intune deploy with jamf pro microsoft dev box faqs security add and manage domains single sign on setup manage connections troubleshoot faqs general domains enforcement identity providers user management provision scim setup group mapping migrate just in time auto provision troubleshoot enforce sign in configure roles and permissions core roles custom roles hardened docker desktop enhanced container isolation enable eci configure advanced settings limitations faqs settings management use a json file use the admin console desktop settings reporting settings reference air gapped containers registry access management image access management namespace access organization access tokens home manuals docker scout how tos create an exception using the vex create an exception using the vex copy as markdown open markdown ask docs ai claude open in claude table of contents prerequisites introduction to vex vexctl example example json document verifying vex documents attach vex documents to images attestation image filesystem vulnerability exploitability exchange vex is a standard format for documenting vulnerabilities in the context of a software package or product docker scout supports vex documents to create exceptions for vulnerabilities in images note you can also create exceptions using the docker scout dashboard or docker desktop the gui provides a user friendly interface for creating exceptions and it s easy to manage exceptions for multiple images it also lets you create exceptions for multiple images or your entire organization all at once for more information see create an exception using the gui prerequisites to create exceptions using openvex documents you need the latest version of docker desktop or the docker scout cli plugin the vexctl command line tool the containerd image store must be enabled write permissions to the registry repository where the image is stored introduction to vex the vex standard is defined by a working group by the united states cybersecurity and infrastructure security agency cisa at the core of vex are exploitability assessments these assessments describe the status of a given cve for a product the possible vulnerability statuses in vex are not affected no remediation is required regarding this vulnerability affected actions are recommended to remediate or address this vulnerability fixed these product versions contain a fix for the vulnerability under investigation it is not yet known whether these product versions are affected by the vulnerability an update will be provided in a later release there are multiple implementations and formats of vex docker scout supports the openvex implementation regardless of the specific implementation the core idea is the same to provide a framework for describing the impact of vulnerabilities key components of vex regardless of implementation includes vex document a type of security advisory for storing vex statements the format of the document depends on the specific implementation vex statement describes the status of a vulnerability in a product whether it s exploitable and whether there are ways to remediate the issue justification and impact depending on the vulnerability status statements include a justification or impact statement describing why a product is or isn t affected action statements describe how to remediate or mitigate the vulnerability vexctl example the following example command creates a vex document stating that the software product described by this vex document is the docker image example app v1 the image contains the npm package express 4 17 1 the npm package is affected by a known vulnerability cve 2022 24999 the image is unaffected by the cve because the vulnerable code is never executed in containers that run this image s gm copying true settimeout copying false 2000 vexctl create author author example com product pkg docker example app v1 subcomponents pkg npm express 4 17 1 vuln cve 2022 24999 status not_affected justification vulnerable_code_not_in_execute_path file cve 2022 24999 vex json here s a description of the options in this example author the email of the author of the vex document product package url purl of the docker image a purl is an identifier for the image in a standardized format defined in the purl specification docker image purl strings begin with a pkg docker type prefix followed by the image repository and version the image tag or sha256 digest unlike image tags where the version is specified like example app v1 in purl the image repository and version are separated by an subcomponents purl of the vulnerable package in the image in this example the vulnerability exists in an npm package so the subcomponents purl is the identifier for the npm package name and version pkg npm express 4 17 1 if the same vulnerability exists in multiple packages vexctl lets you specify the subcomponents flag multiple times for a single create command you can also omit subcomponents in which case the vex statement applies to the entire image vuln id of the cve that the vex statement addresses status this is the status label of the vulnerability this describes the relationship between the software product and the cve vuln the possible values for the status label in openvex are not_affected affected fixed under_investigation in this example the vex statement asserts that the docker image is not_affected by the vulnerability the not_affected status is the only status that results in cve suppression where the cve is filtered out of the analysis results the other statuses are useful for documentation purposes but they do not work for creating exceptions for more information about all the possible status labels see status labels in the openvex specification justification justifies the not_affected status label informing why the product is not affected by the vulnerability in this case the justification given is vulnerable_code_not_in_execute_path signalling that the vulnerability can t be executed as used by the product in openvex status justifications can have one of the five possible values component_not_present vulnerable_code_not_present vulnerable_code_not_in_execute_path vulnerable_code_cannot_be_controlled_by_adversary inline_mitigations_already_exist for more information about these values and their definitions see status justifications in the openvex specification file filename of the vex document output example json document here s the openvex json generated by this command s gm copying true settimeout copying false 2000 context https openvex dev ns v0 2 0 id https openvex dev docs public vex 749f79b50f5f2f0f07747c2de9f1239b37c2bda663579f87a35e5f0fdfc13de5 author author example com timestamp 2024 05 27t13 20 22 395824 02 00 version 1 statements vulnerability name cve 2022 24999 timestamp 2024 05 27t13 20 22 395829 02 00 products id pkg docker example app v1 subcomponents id pkg npm express 4 17 1 status not_affected justification vulnerable_code_n...