Docker Hub
Last updated: Nov 3, 2026
Rationale
Docker Hub is the public container registry where Fluid Attacks publishes the images of its scanners and of the CI Gate. Thus, customers can run them with one Docker command.
These are the primary reasons why Fluid Attacks selected it and not other alternatives:
- It is the default registry of Docker.
An image name without a registry prefix goes to Docker Hub.
Thus,
fluidattacks/forcesoperates in all CI systems and workstations without more configuration. - It hosts public images in an organization namespace. Thus, all the images of Fluid Attacks have one origin that users know.
- It supports multi-platform images. Thus, one tag serves amd64 and arm64 hosts.
- It supports organization access tokens with the scope of one repository. Thus, each component publishes with credentials that cannot change the images of the other components.
- The base images that Fluid Attacks builds on are published there, for example, the official Nix image, which Fluid Attacks pins by digest.
Alternatives
At this time, Fluid Attacks does not examine alternatives. Customers already pull the images of Fluid Attacks from Docker Hub, and it is the default registry of Docker. Fluid Attacks also publishes the same images to the GitHub Container Registry to give users a second registry, not to replace Docker Hub.
Usage
Fluid Attacks uses Docker Hub for these tasks:
- To publish the public images of its scanners for SAST, SCA, DAST, MAST, and CSPM, and of the CI Gate. Nix builds them, and GitLab CI pushes them as multi-platform manifests.
- To pull the pinned base images of its CI container image and jobs.
Fluid Attacks does not use Docker Hub for these tasks:
- To host private images. These images are in Amazon ECR, and Batch and EKS use them.