Inspecting Docker images on Windows

By default, Docker Inspector pulls (using Docker) and uses container-based image inspector services. These services run on Linux operating systems. On Windows, Docker must be configured for Linux containers in order for these Linux-based images to be pulled and started by Docker Inspector.

Docker Inspector also supports more advanced deployment options that avoid this requirement by using image inspector services running elsewhere in the network; for more information, refer to the Docker Inspector documentation.

Docker Inspector uses Docker to mount a shared directory (a directory inside Detect's output directory, which is controlled via property detect.output.path) so that it can be accessed (read from and written to) by the image inspector container. Consequently Docker must have permissions sufficient to mount read/write directories within Detect's output directory.

Docker Inspector constructs the initial file system that a container would have if you ran the target image. All component discovery (including package manager discovery and signature scanning) is based on this file system. In order to construct the file system accurately, the Detect user must have permission to create symbolic links.

For important information on a Docker for Windows bug that might affect Detect, refer to the troubleshooting page.