Check D3 · provenance family · automatic · one of the 11 Docker Desktop checks
The question this check asks: does the pull count of this extension fit the age of its Docker Hub repository? A Docker Desktop extension is a Hub image, the Hub counts every pull of it, and that count is the only popularity number the platform offers — stars are almost unused here. The check reads the count against the one thing that cannot be bought: the day the repository was registered.
Popularity is the argument an installer makes to themselves. A number in the hundreds of thousands says other people went first, and on Docker Hub that number is a pull count, which measures pulls and nothing else: a CI job that pulls the image on every build adds to it, a script in a loop adds to it, and an install from Docker Desktop's marketplace tab is one pull, the same as docker pull from a terminal. It is cheap to inflate and the Hub publishes no history of it, only the total. What cannot be inflated is the repository's registration date. Ten thousand pulls in the first two weeks of a repository nobody had heard of is one of two things — a launch with a company and a marketing plan behind it, or a count manufactured to look like one — and on this platform the second reading has an extra edge. Docker paused new marketplace submissions on 16 June 2026, so a repository that young cannot be listed; it reaches a machine only by image reference, on a Docker Desktop whose user has turned the marketplace-only setting off. A count that outran its provenance, on an image outside the marketplace, is the shape this check names. No malicious Docker Desktop extension has been publicly reported as of 18 September 2026; the check is weighted on how the number is made, not on an incident.
D3 reads two fields of the Hub repository record from /v2/repositories/{owner}/{name}/: pull_count and date_registered. When the count is at least 10,000 (dde_traction_pulls) and the repository is under 14 days old (dde_traction_age_days), the finding is dde-traction-mismatch, HIGH, 20 points, and its text carries both numbers: "14,200 pulls on a repository 9 days old — traction outrunning provenance". It is not graded on the marketplace listing, because a repository that young cannot be listed. The scoring table's evidence note:
"D3; pulls outrunning a days-old repository"
The verdict engine is the one behind all 11 Docker Desktop checks: any CRITICAL finding is a BLOCK, any HIGH or MEDIUM finding is a REVIEW, and a report with nothing above INFO is a PASS. The score is 100 minus every fired penalty, floored at zero. D3 never fires alone: a repository under 14 days is under 30, so D2 adds 12, and it is not in the frozen index, so D5 adds 15 — 47 points, a score of 53, amber, and a REVIEW before the publisher or the install surface has been read. On the personal-default profile a HIGH is a warning and an ask before docker extension install runs; on org-strict every HIGH is a block. D3 feeds the Clone dimension with D1, D2, D4, D5, D8 and D10; a dimension takes the worst of its checks and reads PASS only when every one of them ran.
On the marketplace as it stands, none. In the 18 September 2026 measurement of all 50 listed extensions, run locally through the same code as /v1/dde/score, D3 fired on nothing: every repository was at least 853 days old, and the pull counts ran from about 12,000 at the bottom, through a median of 70,000, to 2.4 million on docker/disk-usage-extension, a repository registered on 18 January 2022. Those are large counts on old repositories, which is what the check expects popularity to look like. On this frozen marketplace the check is a note-taker with nothing to note; it becomes a finding on the image that is not in the index.
Where the cost lands is stated plainly. A vendor whose launch really does draw ten thousand pulls in its first fortnight is HIGH on this check for those 14 days, with D2 and D5 beside it; the fix is the calendar and the report shows the two numbers for the reader to weigh. A publisher whose own pipeline pulls a fresh repository's image on every build can reach the threshold on its own — the count is theirs, and so is the finding. In both cases a REVIEW is an ask, not a refusal, on the personal-default profile. The check reads the record as it is today, so nothing needs re-running: on the fourteenth day it stops firing on its own.
The Hub publishes a cumulative count and no time series, so D3 can only read the total against the repository's age. A sudden burst of pulls on a repository from 2022 is invisible to it; the velocity check that exists for GitHub stars (C3) has no Hub equivalent to read. Stars are not read at all: 33 of the 50 listed extensions have none and the most-starred has 24, so the field says nothing on this platform. Pulls are not installs — the count cannot say how many machines the image reached, or whether any of them ran Docker Desktop. And the check is not a popularity score: the least-pulled listing and the most-pulled score the same on it, because both are old. The number says nothing about the image's contents; the labels, the metadata and the layers are other checks' evidence.
RepoGates assesses a Docker Desktop extension on request — through the API, the MCP server (platform="dde") and the preflight for docker extension install. It does not see an extension installed from Docker Desktop's own Extensions Marketplace tab, which is the app's own fetch; the board inside Docker Desktop is not built, and cannot be — its marketplace is a native window no browser extension sees. The image is never pulled and its code is not read: a PASS means the provenance and the declared install surface are clean, never that the backend or the host binaries were inspected.
The Hub API answers without a token, and the repository record carries both numbers this check reads in one response — the count and the date are rarely read together on the Hub's own page:
curl -s https://hub.docker.com/v2/repositories/docker/disk-usage-extension/ \
| jq '{date_registered, pull_count, star_count}'Docker's disk-usage extension answers January 2022 and about 2.4 million: the most-pulled extension on the marketplace, on one of its oldest repositories. Then ask RepoGates for the whole report with a personal API token from the account page:
curl -s -H 'Authorization: Bearer rgp1.…' \
https://api.repogates.com/v1/dde/score/docker/disk-usage-extension \
| jq '{verdict, score, traction: [.findings[] | select(.check == "dde-traction-mismatch")]}'From an agent, check_repo("docker", "disk-usage-extension", platform="dde") on the MCP server returns the same report; in Claude Code with the plugin installed, a Bash line of docker extension install docker/disk-usage-extension is sent to the preflight before it runs. Read the count beside the publisher (D1) and the index (D5): five figures of pulls on a repository registered this month, from a namespace with no badge, on an image Docker does not list, is the launch this check exists to ask about.
Why 10,000 pulls in 14 days? Because that is more than a genuine unknown gathers in its first fortnight and less than a launch with a company behind it would mind being asked about. The least-pulled extension on Docker's marketplace has about 12,000 pulls after more than two years; the median has 70,000. A repository that reaches five figures inside two weeks, on a marketplace that has accepted no new listing since 16 June 2026, is unlisted by construction and has a count that outran its provenance — which is what the finding says, in two numbers.
Are Docker Hub pull counts reliable? They are a count of pulls, not of installs or of people. A CI job that pulls the image on every build adds to it; a script in a loop adds to it; an install from Docker Desktop's marketplace tab is one pull, the same as docker pull from a terminal. The number is cheap to inflate, which is exactly why the check reads it only against the repository's age: a count can be manufactured, a registration date cannot.
Would a popular new extension be flagged? Yes, for 14 days, and this page says so rather than hiding it. A vendor whose launch really does draw ten thousand pulls in its first fortnight is REVIEW on this check for those 14 days, beside the extension-age and marketplace-listing findings any repository that young carries. The report names the two numbers, and the reader who knows the launch was real can say so; the check cannot tell a launch from a loop, and does not pretend to.
D2 Extension age — the date this check reads the count against, and the finding that always arrives with it · V3 Traction mismatch — installs against publication date on the VS Code Marketplace · C3 Star velocity and traction — the GitHub analogue, which has a history to read and so can see a burst · H3 Traction mismatch — downloads against repository age on the Hugging Face Hub.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of all 50 extensions in Docker's marketplace index, run locally through the same code as the API, and their Docker Hub records as read the same day; Docker's docs on the marketplace pause as read on 18 September 2026; weights from the product's scoring table.