Docker Hub
Last updated: Sep 23, 2026
Rationale
Docker Hub is the public container registry where we publish the images of our scanners and of the CI Gate, so customers can run them with a single Docker command.
The main reasons why we chose it over other alternatives are:
- It is the default registry of Docker.
An image name without a registry prefix resolves to Docker Hub,
so
fluidattacks/forcesworks in every CI system and workstation without extra configuration. - It hosts public images under an organization namespace, giving all our images a single, recognizable origin.
- It supports multi-platform images, so one tag serves both amd64 and arm64 hosts.
- It supports organization access tokens scoped to a single repository, so each component publishes with credentials that cannot touch the images of the others.
- It is where the base images we build on are published, such as the official Nix image, which we pin by digest.
Alternatives
No alternatives are currently being considered, as Docker Hub is the registry customers already pull our images from and the default one for Docker. The same images are also published to the GitHub Container Registry to give users a second registry to pull from, not to replace Docker Hub.
Usage
We use Docker Hub for:
- Publishing the public images of our scanners for SAST, SCA, DAST, MAST and CSPM, and of the CI Gate, built with Nix and pushed as multi-platform manifests by GitLab CI.
- Pulling the pinned base images of our CI container image and jobs.
We do not use Docker Hub for:
- Hosting private images, which live in Amazon ECR and are consumed by Batch and EKS.