Well I think I may have mis-stated it. They offer scanning for Docker Cloud, which I understand to be their private registry / dev platform / once-and-future-Pa

Well I think I may have mis-stated it. They offer scanning for Docker Cloud, which I understand to be their private registry / dev platform / once-and-future-PaaS. So it's an additional paywalled feature for private images, not for the public ones. And, in fairness, it's a surprisingly tricky problem which many well-heeled customers see as worth paying for. At Pivotal we've been working on "AppDog" to do something similar: inspect running applications on Cloud Foundry, tell you what dependencies are installed, what their licenses are, whether there are updates available and so on. And yeah. It's harder than it looks. There are edge cases upon edge cases. (Of course, nothing I say should be considered official comment etc etc).