Docker Hub Search & Validate
VS Code extension to search and validate Docker Hub images and tags without leaving your Dockerfile and docker-compose.yaml files.
Features
- Image autocompletion on
FROM … (Dockerfile) and image: … (compose) lines: searches Docker Hub live as you type (official images first, with stars and pull counts).
- Tag autocompletion: when you type
: after the name, it lists the repository's real tags.
- Inline validation: underlines the image if it doesn't exist on Docker Hub (error) and the tag if it doesn't exist (warning), right in the file.
- Tag quick-fix: if the tag doesn't exist, offers to replace it with similar valid tags in one click.
:latest warning: suggests pinning a specific version when :latest is used or no tag is set.- Hover: hover over an image to see its description, stars, pulls, tag validity and a vulnerability summary (critical/high/medium/low) — the same data Docker Hub shows (via Docker Scout, no
docker login required).
Docker Hub: Search image… command: an interactive search (Quick Pick) that inserts image:tag at the cursor.
Only Docker Hub is validated/autocompleted. Images with a custom registry (ghcr.io/…, localhost:5000/…, etc.) or with variables ($VERSION) are ignored.
Development
npm install
npm run compile # type-check (tsc --noEmit) + bundle with esbuild → dist/extension.js
npm run watch # bundle in watch mode during development
Press F5 in VS Code to open a development window with the extension loaded.
Packaging
npm install -g @vscode/vsce
npm run package # production (minified) build into dist/
npm run vsix # generates an installable .vsix
Bundling is done with esbuild (see esbuild.js), following
VS Code's official recommendation: all code is bundled into dist/extension.js
and the vscode module is marked as external.
Configuration
| Setting |
Default |
Description |
dockerHubSearch.validateOnOpenAndSave |
true |
Validate automatically on open/save/edit. |
dockerHubSearch.searchResultLimit |
25 |
Maximum number of search results. |
dockerHubSearch.tagResultLimit |
50 |
Maximum number of tags in autocompletion. |
dockerHubSearch.cacheTtlSeconds |
300 |
TTL of the Docker Hub response cache. |
dockerHubSearch.showVulnerabilities |
true |
Show the vulnerability summary (Docker Scout) on hover. |
dockerHubSearch.warnOnLatestTag |
true |
Warn when using :latest or not pinning a tag. |
Technical notes
It uses the public Docker Hub API (no authentication) via Node's native fetch:
- Search:
GET https://hub.docker.com/v2/search/repositories/?query=…
- Tags:
GET https://hub.docker.com/v2/repositories/{namespace}/{repo}/tags/
- Validation:
GET …/tags/{tag}/ → 200/404
- Tag digest:
GET …/tags/{tag}/ → images[].digest
Vulnerabilities use the public (anonymous) Docker Scout GraphQL API
(POST https://api.scout.docker.com/v1/graphql, query imageSummariesByDigest),
the same data as the Docker Hub tags tab. No docker login required.
Responses are cached in memory to avoid repeated requests while typing.
