StackRadar vs Docker Scout
Docker Scout is Docker’s image analysis service: layer-level SBOMs, vulnerability matching against many advisory sources, and base-image recommendations, integrated into Docker Desktop and Docker Hub.
Facts last checked . Prices and features change — verify with the vendor before deciding.
What Docker Scout does well
- Excellent base-image recommendations and layer-level attribution of vulnerabilities.
- Pulls from a broad set of advisory sources including CISA KEV and EPSS data.
- Integrated into Docker Desktop, Docker Hub and CI with minimal setup.
- Cheap and published: free for one repository, unlimited with Docker Team at $15 per user per month.
How Docker Scout and StackRadar differ
The differences are about how the two are built and sold, not a feature checklist. Each point below is a structural fact you can verify on the vendor's own documentation.
- No Kubernetes capability at all. Scout scans images in a registry; it cannot say which vulnerable images are running in a cluster, in which namespace, or from which Helm release.
- Per-user pricing tied to the Docker subscription rather than to clusters.
- A registry-centric view drifts from reality: images deployed from other registries, sidecars injected by a mesh, or images that changed tags are invisible to it.
- StackRadar complements rather than replaces it — Scout at build time, StackRadar at run time.
Side by side
| Axis | StackRadar | Docker Scout |
|---|---|---|
| Where it runs | One Helm chart in the cluster, source published; managed dashboard | Docker Desktop, Docker Hub, CI |
| Kubernetes runtime inventory | Yes — every running image, with its workload, Helm release and ArgoCD application | None |
| SBOM | CycloneDX 1.6 per running image (Syft), stored and re-checked as new advisories land | Yes, layer-level |
| Prioritisation | Radar Score — CVSS, EPSS and CISA KEV combined in a published formula | CVSS with KEV and EPSS data shown |
| History and trends | 30 days (Free), 1 year (Pro), 2 years (Business) | Per repository |
| Multi-cluster view | One dashboard across every cluster in the organisation | Not applicable |
| Scanner source | Published on GitHub; releases signed and version-pinned | Closed (CLI plugin open source) |
| Pricing | Published: Free $0 · Pro $59/mo · Business $199/mo | Free / $15 per user per month (Docker Team) |
| Data residency | EU only; only the SBOM leaves the cluster | Docker SaaS, US |
Pricing
Docker Scout: Docker Scout is free for one repository. Unlimited repositories come with Docker Team at $15 per user per month or Docker Business at $24 per user per month. Pricing is per Docker seat and unrelated to the number of clusters you run.
StackRadar: Free for one cluster with 30 days of history; Pro at $59 per month for up to five clusters and one year of history; Business at $199 per month for up to fifteen clusters and two years. Every plan scans every image you run. Full details on the pricing page.
Which should you choose?
Choose Docker Scout if
- You want vulnerability feedback at build time, in Docker Desktop and CI.
- You need base-image recommendations with layer-level detail.
- Your images all live on Docker Hub and you already pay for Docker Team.
- You do not need to know what is running in Kubernetes.
Choose StackRadar if
- You need the runtime view: which running pods carry a given CVE, right now and last month.
- Your clusters pull from several registries, not just Docker Hub.
- You want Helm-release and ArgoCD context on every finding.
- You want a per-cluster price instead of a per-seat one.
Frequently asked questions
Does Docker Scout scan Kubernetes clusters?
No. Docker Scout analyses images in registries and on the Docker Desktop host. It has no view of what is deployed in a Kubernetes cluster.
Should I use Docker Scout or StackRadar?
Both, if you can: they answer different questions. Scout tells you whether an image is vulnerable before you push it; StackRadar tells you which running workloads carry a vulnerability and keeps that answer current as new advisories land.