Check D1 · provenance family · automatic · one of the 11 Docker Desktop checks
The question this check asks: who is the Docker Hub account behind this extension, does Docker Hub vouch for it, and how long has it existed? A Docker Desktop extension is a Docker Hub image, so its publisher is a Hub namespace — an organisation or a user — and the Hub's record of that namespace is the whole of the provenance the listing arrives with.
Docker's own SDK security page, rewritten on 10 October 2025, says an extension runs with the same permissions as the Docker Desktop user, can run any Docker command, run binaries and read the files that user can read, and ends with the advice that matters here: "Make sure you trust the publisher or author of the extension when you install it". Trust the publisher is the instruction, and a Docker Hub namespace costs a sign-up. Nothing else about the account is visible from inside Docker Desktop, so this check reads what the Hub knows: whether the account carries a badge and when it joined.
Two things make the publisher the right place to start. Docker's manual review of marketplace submissions was paused on 9 January 2024; from then on the gate was an automated check of the required labels and the metadata schema, and the Marketplace page itself says its extensions are "not subject to a full security audit". Then on 16 June 2026 Docker paused new submissions altogether, so the marketplace is a frozen list of 50 extensions from 45 publishers, and anything installed outside it has, in Docker's words, "not been reviewed at all". No malicious Docker Desktop extension has been publicly reported as of 18 September 2026; this check is weighted on Docker's own description of the surface, not on an incident.
D1 reads the publisher's account record from the Hub API — /v2/orgs/{owner}/, or /v2/users/{owner}/ when the namespace is a person rather than an organisation. Two findings can come out of it. dde-unverified-publisher fires when the record's badge is neither verified_publisher nor official; a user record has no badge field at all, so it always fires there. Its severity depends on the state the code calls settled: the image reference is in Docker's marketplace index and the Hub repository is at least 90 days old (dde_established_days). Listed and established, it is INFO — a note on the report, no points. On an unlisted or new image it is HIGH and costs 15 points. The scoring table's evidence note:
"D1; no Docker Hub verified-publisher badge — a note on a listed, established extension (most of the 45 marketplace publishers carry none, measured 2026-09-18), HIGH on an unlisted or new one"
dde-publisher-age is not graded: when the account's date_joined is under 90 days ago (dde_publisher_age_high_days) it is HIGH and costs 18 points, listed or not. Its note:
"D1; publisher account under 90 days — mirrors owner-account-age"
The verdict engine is the one behind all 11 Docker Desktop checks: any CRITICAL finding is a BLOCK, any HIGH or MEDIUM finding is a REVIEW, and a report with nothing above INFO is a PASS. The score is separate — 100 minus every fired penalty, floored at zero. An unlisted image from a publisher that joined last month fires both: 33 points for D1 alone, 67 before D5 adds its own 15 for the missing listing. On the personal-default profile a HIGH is a warning and an ask before docker extension install runs; on org-strict every HIGH is a block. D1 feeds the Clone dimension with D2–D5, D8 and D10; a dimension takes the worst of its checks and reads PASS only when every one of them ran.
The grading is the measurement's doing. On 18 September 2026 all 50 listed extensions — the whole marketplace — were run locally through the same code as /v1/dde/score: 50 PASS, 0 REVIEW, 0 BLOCK. dde-unverified-publisher fired as a note on 39 of the 50: 11 come from a publisher with verified_publisher (Docker's own five, and Grafana, Portainer, Lacework, Okteto and LocalStack), one from a publisher with open_source, which the check does not treat as verification, and 38 from a publisher with no badge at all — Tailscale, Lens, ngrok, Meshery and mochoa among them. Weighted HIGH regardless of listing and age, D1 alone would have turned nearly four fifths of the marketplace into REVIEW. As shipped, none of the 39 notes moved a verdict. dde-publisher-age fired on none: the youngest publisher account on the marketplace joined 1,032 days before the run and the median is 2,709.
Where the cost does land is honest and stated: a genuinely new publisher, or an established one shipping a private extension to its own developers by image reference. With submissions paused since 16 June 2026 neither can be listed, so their unbadged namespace is HIGH and the report is REVIEW on this check alone. The control run shows the shape — library/nginx, a Hub image that is no extension at all, scored REVIEW 64 on dde-unlisted, dde-unverified-publisher and dde-no-source. The check reads the account record as it is today, so a publisher who earns a badge clears the first finding the day the Hub shows it, and the second clears itself once the account is 90 days old.
The badge is a Docker Hub account property. It is not the Reviewed or Not reviewed label in Docker Desktop's marketplace, which records Docker's own manual review, paused since January 2024 — and neither is a security audit, in Docker's words. A badge says who the account is, not what the image does: an account whose credentials were taken would pass this check by construction, exactly as it did the day before, and nothing in the record says who pushed the latest tag. The check does not read the image's labels (that is D8), its metadata or its layers, and it does not look at the publisher's other repositories.
RepoGates assesses a Docker Desktop extension on request — through the API, the MCP server (platform="dde") and the preflight for docker extension install. It does not see an extension installed from Docker Desktop's own Extensions Marketplace tab, which is the app's own fetch; the board inside Docker Desktop is not built, and cannot be — its marketplace is a native window no browser extension sees. The image is never pulled and its code is not read: a PASS means the provenance and the declared install surface are clean, never that the backend or the host binaries were inspected.
The Hub API answers without a token. The organisation record carries the two fields this check reads; Docker's own answers verified_publisher, Tailscale's carries no badge:
curl -s https://hub.docker.com/v2/orgs/tailscale/ | jq '{badge, date_joined}'
curl -s https://hub.docker.com/v2/orgs/docker/ | jq '{badge, date_joined}'
# a user namespace answers on /v2/users/{owner}/ instead, with no badge fieldThen ask RepoGates for the whole report with a personal API token from the account page; the two D1 rows are the ones whose check starts with dde-unverified or dde-publisher:
curl -s -H 'Authorization: Bearer rgp1.…' \
https://api.repogates.com/v1/dde/score/tailscale/docker-extension \
| jq '{verdict, score, d1: [.findings[] | select(.check | startswith("dde-unverified") or startswith("dde-publisher"))]}'From an agent, check_repo("tailscale", "docker-extension", platform="dde") on the MCP server returns the same report; in Claude Code with the plugin installed, a Bash line of docker extension install tailscale/docker-extension is sent to the preflight before it runs and comes back with an ask when D1 is HIGH. Read the answer beside the repository's own age (D2) and whether Docker lists it (D5): unbadged and listed is the marketplace's ordinary shape; unbadged, new and unlisted is the one this page opened with.
Is a publisher without a Docker Hub badge a red flag? Not on its own. In the 18 September 2026 measurement of all 50 listed extensions, 39 come from a publisher with no verified-publisher or official badge — Tailscale, Lens, ngrok, Meshery and mochoa among them — so on a listed, established extension D1 is a note with no points. It costs 15 points, HIGH, only on an image that is not in Docker's marketplace index or whose Hub repository is under 90 days old; a publisher account that joined Docker Hub under 90 days ago costs 18 more.
Is the Hub badge the same as the Marketplace's Reviewed label? No. The badge is a property of the Docker Hub account, read from the organisation record. The Reviewed label in Docker Desktop's marketplace records Docker's own manual review, which Docker paused on 9 January 2024 in favour of an automated check that the Dockerfile carries the required labels and the metadata file matches its schema. Docker's own page says marketplace extensions are not subject to a full security audit. D1 reads the badge and the account's join date, and neither label is a security audit.
Does a verified publisher make the extension trustworthy? No. A badge says who the account is, not what the image does, and the image is never pulled on this tier. An account whose credentials were taken would pass this check by construction, exactly as it did the day before. What the badge and age settle is the cheap version of the problem: a namespace nobody can tie to anyone, created recently, publishing an image that is not in the marketplace.
D2 Extension age — the repository's own age, and the 90-day line that decides whether this check is a note or a finding · D5 Marketplace listing — the other half of settled, and the sharpest signal on this platform · V1 Publisher verification — the same question on the VS Code Marketplace, graded the same way · C1 Owner account age — the GitHub check that dde-publisher-age mirrors.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of all 50 extensions in Docker's marketplace index, run locally through the same code as the API; Docker's SDK security page of 10 October 2025, its Extensions overview of 21 April 2026 and its Marketplace and release-notes pages as read on 18 September 2026; weights from the product's scoring table.