Quick Start: Docker / OCI

Push and pull container images through your private DepAegis registry. Every image is automatically scanned for vulnerabilities and assigned a Software Bill of Materials (SBOM) before it is available to your team.

Prerequisites

• Docker 20+ installed and running (docker --version to verify)
• A DepAegis account with access to an organization

Step 1 — Create an Access Token

You need a Personal Access Token (PAT) to authenticate with the registry.

1. Open the DepAegis dashboard and navigate to Settings → Access Tokens.
2. Click New Token, give it a descriptive name (e.g. docker-ci), and select the Read & Write scope.
3. Copy the token value — it will not be shown again.

Step 2 — Login to the Container Registry

Authenticate Docker against the hosted registry:

docker login app.depaegis.com

When prompted, use your username as the username and the access token as the password.

Step 3 — Tag Your Image for DepAegis

Tag an existing image so Docker knows to push it to your private registry:

docker tag my-app:latest app.depaegis.com/my-org/my-app:latest

Step 4 — Push the Image

docker push app.depaegis.com/my-org/my-app:latest

DepAegis receives the image, unpacks each layer, and runs a vulnerability scan against OSV and NVD databases. A CycloneDX SBOM is generated automatically.

Step 5 — Pull the Image from Another Machine

On any machine with Docker and a valid token:

docker login app.depaegis.com
docker pull app.depaegis.com/my-org/my-app:latest

If your organization has a dependency firewall policy, images that fail the policy will be blocked from pulling. Check the dashboard for policy violation details.

Step 6 — Verify Scan Results in the Dashboard

1. Open the app.depaegis.com dashboard → Images.
2. Find my-org/my-app and click it to open the image detail view.
3. Review the Vulnerabilities tab for CVEs grouped by severity (Critical, High, Medium, Low).
4. Review the SBOM tab for the full dependency inventory in CycloneDX format.