Add Docker Scout support for RISC-V64

[gounthar]

Overview

Add Docker Scout support for RISC-V64 architecture. Docker Scout is Docker's security and analysis CLI plugin that provides vulnerability scanning, base image recommendations, and SBOM (Software Bill of Materials) generation.

Why Docker Scout?

Security Benefits:

• CVE scanning for container images
• Vulnerability prioritization and remediation advice
• Base image update recommendations
• Policy evaluation for security compliance

Current State:

• Docker Scout is actively maintained by Docker Inc.
• Uses the same plugin architecture as Buildx
• Source: https://github.com/docker/scout-cli

Gap: No official RISC-V64 binaries available

Implementation Plan

Phase 1: Weekly Builds

• Create scout-weekly-build.yml workflow
• Clone https://github.com/docker/scout-cli
• Build native RISC-V64 binary using Go
• Create releases with pattern scout-vX.Y.Z-riscv64 (official) or scout-vYYYYMMDD-dev (development)
• Schedule: Sunday 06:00 UTC (after Buildx)

Phase 2: Release Tracking

• Create track-scout-releases.yml workflow
• Auto-detect new Docker Scout releases
• Trigger builds automatically
• Create tracking issues

Phase 3: Debian Packaging

• Create debian-scout/ directory with packaging files
• Create build-scout-package.yml workflow
• Package as docker-scout-plugin
• Install to /usr/libexec/docker/cli-plugins/docker-scout
• Auto-trigger on scout release completion

Phase 4: RPM Packaging

• Create rpm-scout/ directory with spec file
• Create build-scout-rpm.yml workflow
• Package as docker-scout-plugin
• Auto-trigger on scout release completion

Phase 5: Gentoo Overlay

• Create scripts/generate-scout-ebuild.sh
• Add to generate-gentoo-overlay-modular.sh
• Package as app-containers/docker-scout

Phase 6: Automation

• Create .updatecli.d/gentoo-scout.yaml for version tracking
• Add to UpdateCLI workflow
• Auto-create PRs for new versions

Phase 7: Documentation

• Update CLAUDE.md with Scout information
• Update README.md with installation instructions
• Add Scout testing procedures to testing docs

Technical Details

Source Repository: https://github.com/docker/scout-cli
Build Method: Native Go build on RISC-V64 runner
Binary Output: docker-scout (CLI plugin)
Install Path: /usr/libexec/docker/cli-plugins/docker-scout

Build Command:

cd scout-cli
export GOOS=linux GOARCH=riscv64 CGO_ENABLED=0
make binary

Usage:

docker scout version
docker scout cves <image>
docker scout quickview <image>
docker scout recommendations <image>

Dependencies

• Docker CLI (for plugin framework)
• Network access (for CVE database queries)
• No additional binaries required

Testing Checklist

• Binary builds successfully on RISC-V64
• docker scout version shows correct version
• Can scan local images
• Can query CVE database
• Debian package installs correctly
• RPM package installs correctly
• Plugin auto-detected by Docker CLI
• Works with docker scout command

Success Criteria

• Weekly automated builds producing RISC-V64 binaries
• Debian and RPM packages available
• Auto-tracking of upstream releases
• Documentation updated
• Installation tested on RISC-V64 hardware

Related

• Similar implementation to Buildx: .github/workflows/buildx-weekly-build.yml
• Plugin architecture: https://docs.docker.com/engine/extend/

[gounthar]

Investigation Results

After attempting to implement Docker Scout support, I've discovered a blocking issue:

Docker Scout is Closed Source

• The docker/scout-cli repository only contains pre-built binaries, not source code
• No Makefile or build instructions exist
• The repository description: "This repository contains installable binaries of the docker scout CLI plugin"

No RISC-V64 Binaries Available

Official v1.18.4 release assets:

docker-scout_1.18.4_darwin_amd64.tar.gz
docker-scout_1.18.4_darwin_arm64.tar.gz
docker-scout_1.18.4_linux_amd64.tar.gz
docker-scout_1.18.4_linux_arm64.tar.gz
docker-scout_1.18.4_windows_amd64.zip
docker-scout_1.18.4_windows_arm64.zip

No linux_riscv64 binary is provided.

Conclusion

Docker Scout cannot be built for RISC-V64 because:

1. Source code is not publicly available
2. Official releases don't include RISC-V64 binaries
3. We cannot compile it ourselves like other Docker components

Options

1. Request RISC-V64 support from Docker (file upstream issue)
2. Document the limitation in our README
3. Revert Scout implementation (workflows, packaging, docs)

Build Failure Root Cause

The workflow failure at https://github.com/gounthar/docker-for-riscv64/actions/runs/19298514617 was caused by attempting to run make binary on a repository that has no build system.

---

I recommend we:

• Close this issue or mark as blocked/upstream
• Revert the Scout-related commits
• Add a note in README about Scout not being available for RISC-V64
• Consider filing an upstream feature request to Docker

cc @gounthar

[gounthar]

Resolution

After thorough investigation, Docker Scout cannot be implemented for RISC-V64 due to:

1. Closed Source: Docker Scout source code is not publicly available
2. No RISC-V64 Binaries: Official releases only support amd64/arm64 architectures
3. No Build System: The docker/scout-cli repository only contains pre-built binaries

Actions Taken

1. ✅ Reverted all Scout-related commits (workflows, packaging, documentation)
2. ✅ Added Docker Scout to the "Known Limitations" section in README.md
3. ✅ Documented the blocker with a link to this issue

Options

If RISC-V64 support becomes a priority:

• File upstream request: Ask Docker to provide RISC-V64 binaries
• Community petition: Gather interest for RISC-V64 support
• Alternative tools: Use other security scanning tools compatible with RISC-V64

For now, Docker Scout is officially marked as not available for this project.

This issue is closed as won't fix (blocked by upstream limitations).