Docker Hub
Connect Docker Hub to Safeguard. The access permission the personal access token needs, which token types work, and step-by-step setup.
What it does
The Docker Hub card connects Safeguard to container images on Docker Hub. Safeguard lists the repositories of your Docker Hub namespace and their tags, and each image you select becomes a project that Safeguard scans for an SBOM and vulnerability findings. Find the card under Integrations on the Project/Product tab.
Public vs private
| Public | Private | |
|---|---|---|
| What you enter | A Docker Hub URL such as https://hub.docker.com/_/nginx or https://hub.docker.com/r/<user>/<image> | Your Docker Hub username and a personal access token |
| Credential needed | None | A Docker Hub personal access token (PAT) |
| What you can select | The public images you add by URL | The repositories in the namespace you connect, with their tags |
Private image scans
Safeguard uses the token to list your repositories and tags. The scan's image pull does not use this token yet, so a private image the scanner cannot pull is reported as a failed scan with the registry's error.
Supported auth methods
| Method | Use it when | Notes |
|---|---|---|
| Username and personal access token | Private repositories | Recommended. The token is sent once to Docker Hub's login endpoint to obtain a short-lived bearer token. |
| Username and account password | Only if you cannot create a PAT | Works when your organization does not enforce SSO. Docker recommends a PAT instead. |
| None | Public images | Nothing to create. |
Permissions required
Safeguard only reads from Docker Hub. It never pushes, deletes or changes images, tags or repository settings.
Personal access token
| Access permission | Required? | What Safeguard uses it for |
|---|---|---|
| Repo Read-only | Required for private repositories | Signing in (POST /v2/users/login), listing the namespace's repositories and listing each repository's tags |
| Repo Public Read-only | Enough for public repositories only | Listing public repositories of the namespace; private repositories are not visible |
| Allow Cloud Sandboxes access | Not used | Leave it off |
Least privilege: a PAT with Repo Read-only and an expiration date. Docker scopes a PAT's repository permission to every repository your account can reach, so use an account that can see only what Safeguard should scan.
Token types
| Token type | Works? | Notes |
|---|---|---|
| Personal access token, Repo Read-only | Yes (recommended) | |
| Personal access token, Repo Read & Write or Repo Read, Write, Delete | Works, not recommended | Safeguard never writes or deletes |
| Personal access token, Repo Public Read-only | Partly | Only public repositories are listed |
| Organization access token (OAT) | No | Safeguard lists repositories on the /v2/repositories/{namespace} path, which Docker Hub rejects for OATs |
| Account password | Works, not recommended | Not available when the organization enforces SSO |
A GitHub token (ghp_...) or any other vendor's token | No | Safeguard detects a pasted GitHub token and says so |
Expiry: choose 30 days or 90 days, or a Custom date up to one year. Docker's default, None, never expires; avoid it. You cannot change a PAT's expiration later, so rotate by creating a new token.
What we never need: write or delete permissions, Cloud Sandboxes access, organization owner rights, or your account password when a PAT is possible.
Step-by-step setup
Create the credential in Docker Hub
- Sign in to Docker Home.
- Select your avatar, then Account settings.
- Select Personal access tokens, then Generate new token.
- Enter an Access token description (for example
Safeguard), pick an Expiration date, and under Access permissions choose Repo Read-only. - Select Generate, then copy the token. Docker shows it once and does not store it.
Or with the Docker CLI
Docker has no CLI command that creates a PAT. To check the token before you paste it into Safeguard:
docker login --username <your-docker-id>
# Password: paste the PAT
docker logoutConnect it in Safeguard
- Open Integrations and choose the Project/Product tab.
- Click Connect on the Docker Hub card.
- For public images, choose Public, enter a Name, paste a Docker Hub URL, click Add, then Next.
- For private repositories, choose Private, enter a Name, your Docker Hub Username and the Access Token.
- Click Verify Credentials. "Docker Hub credentials verified successfully!" means Docker Hub accepted the token.
- Click Next, select repositories and tags, review, and choose a connect option (fast, progressive or deep scan).
Webhooks and triggers
This integration has no webhooks. Each selected image is scanned when you connect it; to rescan new tags, set a schedule under Integrations > Scheduled or rescan by hand from the project.
What we read and store
- Read: repository names, descriptions and visibility in your namespace, tag names and update dates, and the images you select for scanning.
- Stored: the connection's settings, the SBOM and findings of each scanned image, and the username and token, which are encrypted at rest and never shown again after you save them.
- Not stored: image layers. The image is read for the scan and not kept.
- No customer data from this integration is sent to third-party LLMs.
Troubleshooting
| Message you see | Cause | Fix |
|---|---|---|
Please enter both username and access token to verify | A field is empty | Enter your Docker ID and the PAT |
Docker Hub rejected the credentials for user '<name>'. Verify the Docker Hub username and Personal Access Token, and that the PAT has at least read access. ... | Wrong username, an expired or revoked PAT, or a PAT copied with extra characters | Re-copy the raw token from Docker Hub, check it has not expired, and use your Docker ID (not your email) as the username |
Docker Hub rejected the credentials ... The supplied token starts with 'ghp_' ... | A GitHub token was pasted | Create a Docker Hub PAT instead |
Invalid Docker Hub URL format | The public URL is not a Docker Hub image page | Use https://hub.docker.com/_/<image> or https://hub.docker.com/r/<user>/<image> |
Image is private. Use private authentication. | A private image was added on the Public tab | Use the Private tab with a PAT |
Image not found on Docker Hub | The image name is wrong or the image was deleted | Check the URL on Docker Hub |
Namespace (username/organization) is required for Docker Hub | The connection has no namespace | Enter the username or organization whose repositories you want |
Rotation and disconnect
- Rotate: generate a new PAT, find the connection under Project Configurations on the Project/Product tab, choose Update from its menu, paste the new token and save, then delete the old token in Account settings > Personal access tokens.
- Disconnect: choose Delete from the connection's menu under Project Configurations and confirm Delete configuration, then delete the PAT in Docker Hub.
Vendor references
- Access tokens, checked 2026-10-16.
- Create and manage personal access tokens, checked 2026-10-16.
- Access token reference (permissions), checked 2026-10-16.
- Docker Hub API reference (authentication, organization access tokens), checked 2026-10-16.
Amazon ECR
Connect Amazon Elastic Container Registry (ECR) to Safeguard. The IAM permissions the access key needs, which credentials work, and step-by-step setup.
OCI Registry
Connect any registry that speaks the Open Container Initiative (OCI) distribution API to Safeguard. The access a username and token need, which credentials work, and step-by-step setup.