diff --git a/docs/docker_scout_compare.yaml b/docs/docker_scout_compare.yaml
index c9205a92..37e3649c 100644
--- a/docs/docker_scout_compare.yaml
+++ b/docs/docker_scout_compare.yaml
@@ -227,6 +227,46 @@ options:
experimentalcli: false
kubernetes: false
swarm: false
+ - option: policy-bundle
+ value_type: stringArray
+ default_value: '[]'
+ description: OCI reference of a policy bundle to evaluate (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-config
+ value_type: string
+ description: |
+ Path or http(s) URL to a JSON file configuring policy enablement and inputs
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-dir
+ value_type: stringArray
+ default_value: '[]'
+ description: Path to a directory of local .rego policy files (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-file
+ value_type: stringArray
+ default_value: '[]'
+ description: Path or http(s) URL to a .rego policy file (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
- option: ref
value_type: string
description: |-
diff --git a/docs/docker_scout_policy.yaml b/docs/docker_scout_policy.yaml
index 077907ee..e2772f5e 100644
--- a/docs/docker_scout_policy.yaml
+++ b/docs/docker_scout_policy.yaml
@@ -1,6 +1,6 @@
command: docker scout policy
short: |
- Evaluate policies against an image and display the policy evaluation results (experimental)
+ Evaluate local Rego policies against an image and display the results (experimental)
long: |-
The `docker scout policy` command evaluates policies against an image.
The image analysis is uploaded to Docker Scout where policies get evaluated.
@@ -9,16 +9,11 @@ long: |-
usage: docker scout policy [IMAGE | REPO]
pname: docker scout
plink: docker_scout.yaml
+cname:
+ - docker scout policy publish
+clink:
+ - docker_scout_policy_publish.yaml
options:
- - option: env
- value_type: string
- description: Name of the environment to compare to
- deprecated: true
- hidden: true
- experimental: false
- experimentalcli: false
- kubernetes: false
- swarm: false
- option: exit-code
shorthand: e
value_type: bool
@@ -61,26 +56,57 @@ options:
swarm: false
- option: platform
value_type: string
- description: Platform of image to pull policy results from
+ description: Platform of image to evaluate policies against
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- - option: to-env
+ - option: policy-bundle
+ value_type: stringArray
+ default_value: '[]'
+ description: OCI reference of a policy bundle to evaluate (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-config
value_type: string
- description: Name of the environment to compare to
+ description: |
+ Path or http(s) URL to a JSON file configuring policy enablement and inputs
deprecated: false
hidden: false
experimental: false
experimentalcli: false
kubernetes: false
swarm: false
- - option: to-latest
- value_type: bool
- default_value: "false"
- description: Latest image processed to compare to
+ - option: policy-dir
+ value_type: stringArray
+ default_value: '[]'
+ description: Path to a directory of local .rego policy files (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-file
+ value_type: stringArray
+ default_value: '[]'
+ description: Path or http(s) URL to a .rego policy file (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: result-file
+ value_type: string
+ description: |
+ Write the full Rego evaluation result (pass, violations, query bindings and OPA metrics) of each evaluated policy to a JSON file (useful when iterating on local --policy-file policies)
deprecated: false
hidden: false
experimental: false
diff --git a/docs/docker_scout_policy_publish.yaml b/docs/docker_scout_policy_publish.yaml
new file mode 100644
index 00000000..c5ea24b9
--- /dev/null
+++ b/docs/docker_scout_policy_publish.yaml
@@ -0,0 +1,60 @@
+command: docker scout policy publish
+short: |
+ Package local Rego policies into an OCI bundle and push it to a registry (experimental)
+long: |-
+ The docker scout policy publish command packages Rego policies into an OCI policy bundle and pushes it to a registry. The published bundle can then be evaluated with docker scout policy --policy-bundle REFERENCE.
+
+ When no --policy-file or --policy-dir is given, the built-in default policy set is published. Authentication uses your existing registry credentials (run "docker login" first).
+usage: docker scout policy publish [OPTIONS] REFERENCE
+pname: docker scout policy
+plink: docker_scout_policy.yaml
+options:
+ - option: policy-dir
+ value_type: stringArray
+ default_value: '[]'
+ description: |
+ Path to a directory of local .rego policy files to include (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-file
+ value_type: stringArray
+ default_value: '[]'
+ description: Path or http(s) URL to a .rego policy file to include (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+inherited_options:
+ - option: debug
+ value_type: bool
+ default_value: "false"
+ description: Debug messages
+ deprecated: false
+ hidden: true
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: verbose-debug
+ value_type: bool
+ default_value: "false"
+ description: Verbose debug
+ deprecated: false
+ hidden: true
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+examples: " Publish the built-in default policies:\n $ docker scout policy publish registry.example.com/policies:latest\e[0m\n\n Publish a directory of local policies:\n $ docker scout policy publish --policy-dir ./rego registry.example.com/policies:latest\e[0m\n\n Publish specific policy files:\n $ docker scout policy publish --policy-file fixable.rego --policy-file licenses.rego registry.example.com/policies:latest\e[0m"
+deprecated: false
+experimental: false
+experimentalcli: true
+kubernetes: false
+swarm: false
+
diff --git a/docs/docker_scout_quickview.yaml b/docs/docker_scout_quickview.yaml
index 1ff9869c..8932e136 100644
--- a/docs/docker_scout_quickview.yaml
+++ b/docs/docker_scout_quickview.yaml
@@ -115,6 +115,46 @@ options:
experimentalcli: false
kubernetes: false
swarm: false
+ - option: policy-bundle
+ value_type: stringArray
+ default_value: '[]'
+ description: OCI reference of a policy bundle to evaluate (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-config
+ value_type: string
+ description: |
+ Path or http(s) URL to a JSON file configuring policy enablement and inputs
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-dir
+ value_type: stringArray
+ default_value: '[]'
+ description: Path to a directory of local .rego policy files (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
+ - option: policy-file
+ value_type: stringArray
+ default_value: '[]'
+ description: Path or http(s) URL to a .rego policy file (repeatable)
+ deprecated: false
+ hidden: false
+ experimental: false
+ experimentalcli: false
+ kubernetes: false
+ swarm: false
- option: ref
value_type: string
description: |-
diff --git a/docs/scout.md b/docs/scout.md
index 6c9eb4aa..49957fd5 100644
--- a/docs/scout.md
+++ b/docs/scout.md
@@ -9,28 +9,28 @@ Command line tool for Docker Scout
### Subcommands
-| Name | Description |
-|:--------------------------------------------------------------|:--------------------------------------------------------------------------------------------|
-| [`attestation`](scout_attestation.md) | Manage attestations on images |
-| [`cache`](scout_cache.md) | Manage Docker Scout cache and temporary files |
-| [`compare`](scout_compare.md) | Compare two images and display differences (experimental) |
-| [`config`](scout_config.md) | Manage Docker Scout configuration |
-| [`cves`](scout_cves.md) | Display CVEs identified in a software artifact |
-| [`docker-cli-plugin-hooks`](scout_docker-cli-plugin-hooks.md) | runs the plugins hooks |
-| [`enroll`](scout_enroll.md) | Enroll an organization with Docker Scout |
-| [`environment`](scout_environment.md) | Manage environments (experimental) |
-| [`help`](scout_help.md) | Display information about the available commands |
-| [`integration`](scout_integration.md) | Commands to list, configure, and delete Docker Scout integrations |
-| [`policy`](scout_policy.md) | Evaluate policies against an image and display the policy evaluation results (experimental) |
-| [`push`](scout_push.md) | Push an image or image index to Docker Scout |
-| [`quickview`](scout_quickview.md) | Quick overview of an image |
-| [`recommendations`](scout_recommendations.md) | Display available base image updates and remediation recommendations |
-| [`repo`](scout_repo.md) | Commands to list, enable, and disable Docker Scout on repositories |
-| [`sbom`](scout_sbom.md) | Generate or display SBOM of an image |
-| [`stream`](scout_stream.md) | Manage streams (experimental) |
-| [`version`](scout_version.md) | Show Docker Scout version information |
-| [`vex`](scout_vex.md) | Manage VEX attestations on images |
-| [`watch`](scout_watch.md) | Watch repositories in a registry and push images and indexes to Docker Scout |
+| Name | Description |
+|:--------------------------------------------------------------|:-------------------------------------------------------------------------------------|
+| [`attestation`](scout_attestation.md) | Manage attestations on images |
+| [`cache`](scout_cache.md) | Manage Docker Scout cache and temporary files |
+| [`compare`](scout_compare.md) | Compare two images and display differences (experimental) |
+| [`config`](scout_config.md) | Manage Docker Scout configuration |
+| [`cves`](scout_cves.md) | Display CVEs identified in a software artifact |
+| [`docker-cli-plugin-hooks`](scout_docker-cli-plugin-hooks.md) | runs the plugins hooks |
+| [`enroll`](scout_enroll.md) | Enroll an organization with Docker Scout |
+| [`environment`](scout_environment.md) | Manage environments (experimental) |
+| [`help`](scout_help.md) | Display information about the available commands |
+| [`integration`](scout_integration.md) | Commands to list, configure, and delete Docker Scout integrations |
+| [`policy`](scout_policy.md) | Evaluate local Rego policies against an image and display the results (experimental) |
+| [`push`](scout_push.md) | Push an image or image index to Docker Scout |
+| [`quickview`](scout_quickview.md) | Quick overview of an image |
+| [`recommendations`](scout_recommendations.md) | Display available base image updates and remediation recommendations |
+| [`repo`](scout_repo.md) | Commands to list, enable, and disable Docker Scout on repositories |
+| [`sbom`](scout_sbom.md) | Generate or display SBOM of an image |
+| [`stream`](scout_stream.md) | Manage streams (experimental) |
+| [`version`](scout_version.md) | Show Docker Scout version information |
+| [`vex`](scout_vex.md) | Manage VEX attestations on images |
+| [`watch`](scout_watch.md) | Watch repositories in a registry and push images and indexes to Docker Scout |
diff --git a/docs/scout_compare.md b/docs/scout_compare.md
index ca585350..9519b04a 100644
--- a/docs/scout_compare.md
+++ b/docs/scout_compare.md
@@ -28,6 +28,10 @@ Compare two images and display differences (experimental)
| `--org` | `string` | | Namespace of the Docker organization |
| `-o`, `--output` | `string` | | Write the report to a file |
| `--platform` | `string` | | Platform of image to analyze |
+| `--policy-bundle` | `stringArray` | | OCI reference of a policy bundle to evaluate (repeatable) |
+| `--policy-config` | `string` | | Path or http(s) URL to a JSON file configuring policy enablement and inputs |
+| `--policy-dir` | `stringArray` | | Path to a directory of local .rego policy files (repeatable) |
+| `--policy-file` | `stringArray` | | Path or http(s) URL to a .rego policy file (repeatable) |
| `--ref` | `string` | | Reference to use if the provided tarball contains multiple references.
Can only be used with archive |
| `--to` | `string` | | Image, directory, or archive to compare to |
| `--to-env` | `string` | | Name of environment to compare to |
diff --git a/docs/scout_policy.md b/docs/scout_policy.md
index 46735c01..4879ffcc 100644
--- a/docs/scout_policy.md
+++ b/docs/scout_policy.md
@@ -1,19 +1,29 @@
# docker scout policy
-Evaluate policies against an image and display the policy evaluation results (experimental)
+Evaluate local Rego policies against an image and display the results (experimental)
+
+### Subcommands
+
+| Name | Description |
+|:-------------------------------------|:----------------------------------------------------------------------------------------|
+| [`publish`](scout_policy_publish.md) | Package local Rego policies into an OCI bundle and push it to a registry (experimental) |
+
### Options
-| Name | Type | Default | Description |
-|:--------------------|:--------------|:--------|:------------------------------------------------------------|
-| `-e`, `--exit-code` | | | Return exit code '2' if policies are not met, '0' otherwise |
-| `--only-policy` | `stringSlice` | | Comma separated list of policies to evaluate |
-| `--org` | `string` | | Namespace of the Docker organization |
-| `-o`, `--output` | `string` | | Write the report to a file |
-| `--platform` | `string` | | Platform of image to pull policy results from |
-| `--to-env` | `string` | | Name of the environment to compare to |
-| `--to-latest` | | | Latest image processed to compare to |
+| Name | Type | Default | Description |
+|:--------------------|:--------------|:--------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `-e`, `--exit-code` | | | Return exit code '2' if policies are not met, '0' otherwise |
+| `--only-policy` | `stringSlice` | | Comma separated list of policies to evaluate |
+| `--org` | `string` | | Namespace of the Docker organization |
+| `-o`, `--output` | `string` | | Write the report to a file |
+| `--platform` | `string` | | Platform of image to evaluate policies against |
+| `--policy-bundle` | `stringArray` | | OCI reference of a policy bundle to evaluate (repeatable) |
+| `--policy-config` | `string` | | Path or http(s) URL to a JSON file configuring policy enablement and inputs |
+| `--policy-dir` | `stringArray` | | Path to a directory of local .rego policy files (repeatable) |
+| `--policy-file` | `stringArray` | | Path or http(s) URL to a .rego policy file (repeatable) |
+| `--result-file` | `string` | | Write the full Rego evaluation result (pass, violations, query bindings and OPA metrics) of each evaluated policy to a JSON file (useful when iterating on local --policy-file policies) |
diff --git a/docs/scout_policy_publish.md b/docs/scout_policy_publish.md
new file mode 100644
index 00000000..30274935
--- /dev/null
+++ b/docs/scout_policy_publish.md
@@ -0,0 +1,15 @@
+# docker scout policy publish
+
+
+Package local Rego policies into an OCI bundle and push it to a registry (experimental)
+
+### Options
+
+| Name | Type | Default | Description |
+|:----------------|:--------------|:--------|:------------------------------------------------------------------------|
+| `--policy-dir` | `stringArray` | | Path to a directory of local .rego policy files to include (repeatable) |
+| `--policy-file` | `stringArray` | | Path or http(s) URL to a .rego policy file to include (repeatable) |
+
+
+
+
diff --git a/docs/scout_quickview.md b/docs/scout_quickview.md
index b7e139d9..e93828a0 100644
--- a/docs/scout_quickview.md
+++ b/docs/scout_quickview.md
@@ -19,6 +19,10 @@ Quick overview of an image
| `--org` | `string` | | Namespace of the Docker organization |
| `-o`, `--output` | `string` | | Write the report to a file |
| `--platform` | `string` | | Platform of image to analyze |
+| `--policy-bundle` | `stringArray` | | OCI reference of a policy bundle to evaluate (repeatable) |
+| `--policy-config` | `string` | | Path or http(s) URL to a JSON file configuring policy enablement and inputs |
+| `--policy-dir` | `stringArray` | | Path to a directory of local .rego policy files (repeatable) |
+| `--policy-file` | `stringArray` | | Path or http(s) URL to a .rego policy file (repeatable) |
| `--ref` | `string` | | Reference to use if the provided tarball contains multiple references.
Can only be used with archive |
| `--vex-author` | `stringSlice` | `[<.*@docker.com>]` | List of VEX statement authors to accept |
| `--vex-location` | `stringSlice` | | File location of directory or file containing VEX statements |