Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Defender for Containers helps you assess container image vulnerabilities across the full image lifecycle, from code development to cloud deployment.
Comprehensive coverage includes container images from external registries. This feature supports Docker Hub, which is used by enterprises, small businesses, and open-source teams. If you use Docker Hub, Defender for Containers can provide inventory discovery, security posture evaluation, and vulnerability assessment. You get the same core security capabilities available for cloud-native registries such as Azure Container Registry (ACR), Amazon Elastic Container Registry (ECR), and Google Container Registry (GCR).
Key capabilities
Defender for Containers provides the following capabilities for Docker Hub organizations:
Inventory: Identify and list all available container images in the Docker Hub organization.
Vulnerability assessment: Regularly scan the Docker Hub organization account for supported container images, identify vulnerabilities, and provide recommendations for issues that need remediation.
Prerequisites
To use Microsoft Defender for Containers with your organizational Docker Hub accounts, you must own a Docker Hub organization account and have admin permission to manage users. For more information, see How to set up Docker Hub as an external registry
Enable Microsoft Defender for Containers or Defender CSPM for at least one subscription in Microsoft Defender for Cloud.
Onboard the Docker Hub environment
Users with Security admin privileges in Microsoft Defender for Cloud can add a new Docker Hub environment if they also have the required permissions on the Environment settings page.
Each environment maps to one Docker Hub organization. In the onboarding interface, select Docker Hub as the registry type when you add a new external registry environment.
The environment wizard assists with the onboarding process:
Connector Details
Connector name: Specify a unique connector name.
Location: Specify the geographic location where Defender for Cloud stores the data associated with this connector.
Subscription: The hosting subscription that defines the RBAC scope, and billing entity for the Docker Hub environment.
Resource group: for RBAC purposes
Note
Only one subscription can be linked to a Docker Hub environment instance. However, container images from this instance can be deployed to multiple environments protected by Defender for Cloud, outside the boundaries of the associated subscription.
Scanning intervals: Select an interval for scanning the container registry for vulnerabilities.
Select Plans
Multiple plans exist for these kinds of environments:
Foundational CSPM: Basic plan available for all customers, provides inventory capabilities only.
Containers: Offers inventory and vulnerability assessment features.
Defender CSPM: Offers inventory and vulnerability assessment features, plus extra capabilities like attack path analysis and code-to-cloud mapping.
For plan pricing details, see Microsoft Defender for Cloud pricing.
Ensure your Docker Hub environment plans are in sync with your cloud environment plans and share the same subscription to maximize coverage.
Configure Access
To maintain a continuous and secure link between Defender for Cloud and your Docker Hub organization, use a dedicated user with an organization email address. Each Docker Hub connector maps to one Docker Hub organization. Onboard a separate Docker Hub environment connector in Defender for Cloud for each Docker Hub organization that you manage.
Follow the steps in How to set up Docker Hub as an external registry to prepare your Docker Hub organization account for integration.
Provide these parameters from your Docker Hub user to establish a connection.
Organization: Docker Hub organization name
User: Assigned Docker Hub username
Access token: Docker Hub user read-only access token
Review and generate
Review all the configured connector details before onboarding finalization.
Validate connectivity
Verify the connection is successful and displays "Connected" on the environment's settings screen.
Validate feature capabilities
Docker Hub initiates container registry scanning within one hour after onboarding:
Inventory – Make sure your Docker Hub connector and its security status appear in the Inventory view.
Vulnerability Assessment – Ensure you receive the recommendation "(Preview) Container images in Docker Hub registry should have vulnerability findings resolved" for addressing security issues in your Docker Hub container images.
