Check D4 · provenance family · automatic · one of the 11 Docker Desktop checks
The question this check asks: is this image reference imitating one of the 50 that Docker lists? A Docker Desktop extension is named by its Hub reference, namespace/name, and that reference is the whole of what a developer types into docker extension install. The check compares it, character by character, against every reference in Docker's marketplace index.
A Docker Hub namespace costs a sign-up, and docker extension install takes any image reference once the marketplace-only setting is off — the default since Docker Desktop 4.31.0 (6 June 2024) is to allow only listed extensions, and since 4.74.0 (19 May 2026) extensions are off altogether unless turned on. Past those two settings the reference is all there is. tailscale/docker-extension and tailscal/docker-extension are one keystroke apart on the command line and identical in a chat message, a README or an agent's suggestion, and the second is a namespace anyone could register this morning. Docker's own overview of 21 April 2026 says extensions installed outside the marketplace "have not been reviewed at all", which is precisely the path a lookalike takes. What makes the check unusually sharp on this platform is the size of the universe: Docker paused new marketplace submissions on 16 June 2026, so the index is a frozen list of 50 references from 45 publishers, small enough that the net can be exact rather than heuristic. No malicious Docker Desktop extension has been publicly reported as of 18 September 2026, and no lookalike of a listed one; the check is weighted on how cheap the imitation is, not on an incident.
D4 runs when the marketplace index was read — the live copy at desktop.docker.com/extensions/marketplace.json, or the copy committed with the product when the live one cannot be fetched. A reference that is in the index is the original and returns before any comparison; a listed extension is never a lookalike. For any other reference two comparisons run, in lower case, each on a Levenshtein distance of at most one — a single character substituted, inserted or deleted. dde-lookalike:publisher fires when the namespace is not a listed publisher but is one edit from one of the 45. dde-lookalike:name fires when the image name is within one edit of a listed image name — an identical name counts — under a namespace that is not that listed publisher. Only the first match of each kind is reported, and the finding names the listed reference it matched: "publisher 'tailscal' is one edit from the listed 'tailscale' — lookalike pattern". Both are HIGH and cost 18 points, whatever the repository's age. The scoring table's evidence note:
"D4; one edit from a listed publisher, or a listed image name under another publisher — a 50-entry universe, so the net is exact"
The verdict engine is the one behind all 11 Docker Desktop checks: any CRITICAL finding is a BLOCK, any HIGH or MEDIUM finding is a REVIEW, and a report with nothing above INFO is a PASS. The score is 100 minus every fired penalty, floored at zero. D4 never fires alone, because a reference that is not in the index also fires D5's dde-unlisted: 33 points, a score of 67 and a REVIEW. On the personal-default profile a HIGH is a warning and an ask before docker extension install runs; on org-strict every HIGH is a block. When neither the live index nor the committed copy can be read, D4 and D5 are reported as not checked — never as a verdict either way. D4 feeds the Clone dimension with D1–D3, D5, D8 and D10; a dimension takes the worst of its checks and reads PASS only when every one of them ran.
On the marketplace itself, none by construction. In the 18 September 2026 measurement of all 50 listed extensions, run locally through the same code as /v1/dde/score, D4 fired on nothing, and the committed index is tested to be self-consistent: no listed reference is a lookalike of another, and no two of the 45 listed publishers are within one edit of each other. On this frozen marketplace the check is a note-taker with nothing to note; it has something to say only about a reference outside the index.
There it has one false positive worth stating in full. The marketplace's image names are generic: six listed extensions are named docker-desktop-extension (under anchore, gefyra, grafana, okteto, uffizzi and vklokun) and five are named docker-extension (under livecycle, releasecom, remoteit, tailscale and teamgosh). Docker's own naming convention, in other words, and a company that follows it for a private extension — acme/docker-extension, shipped to its own developers by image reference — is an identical listed name under another namespace. The name half fires, beside dde-unlisted, and the report reads REVIEW — 33 points down on those two findings alone. The finding names the listed reference it matched, so the reader who knows the image is their own can see at once why it fired and allow it. That cost is accepted rather than tuned away, because the alternative — ignoring identical names — would exempt exactly the imitation the check exists to catch.
The net is one edit wide and no wider: a namespace two characters from a listed publisher is not matched, and a reference that imitates a listed extension in its title, icon or description rather than its name is not this check's business — the org.opencontainers.image.title label is not compared, and a clone with a copied title under an unrelated namespace is reported by D5 as unlisted, not by D4 as a lookalike. The comparison is against Docker's marketplace index only, not against every namespace on the Hub: an image that imitates some other Hub image, or an official image under library/, is outside its universe. And the check reads the reference, nothing else — it does not read the image's labels, its metadata or its layers, and it says nothing about what the original or the imitation does.
RepoGates assesses a Docker Desktop extension on request — through the API, the MCP server (platform="dde") and the preflight for docker extension install. It does not see an extension installed from Docker Desktop's own Extensions Marketplace tab, which is the app's own fetch; the board inside Docker Desktop is not built, and cannot be — its marketplace is a native window no browser extension sees. The image is never pulled and its code is not read: a PASS means the provenance and the declared install surface are clean, never that the backend or the host binaries were inspected.
Without any tool: read the reference, not the title. Compare the namespace and the image name character by character with the one you meant to install, and look the namespace up on the Hub to see what else it publishes — a lookalike usually has nothing else. Docker's index is a public file, and it is the list this check compares against; the Hub API answers for the namespace without a token:
curl -s https://desktop.docker.com/extensions/marketplace.json | jq -r '.extensions[]' | grep -i tailscale
curl -s https://hub.docker.com/v2/orgs/tailscale/ | jq '{badge, date_joined}'The first line prints tailscale/docker-extension and nothing else; a reference that prints nothing is not listed, whatever it resembles. Then ask RepoGates for the whole report with a personal API token from the account page:
curl -s -H 'Authorization: Bearer rgp1.…' \
https://api.repogates.com/v1/dde/score/tailscale/docker-extension \
| jq '{verdict, score, lookalike: [.findings[] | select(.check | startswith("dde-lookalike"))]}'From an agent, check_repo("tailscale", "docker-extension", platform="dde") on the MCP server returns the same report; in Claude Code with the plugin installed, a Bash line of docker extension install tailscale/docker-extension is sent to the preflight before it runs, and a reference one edit away comes back with an ask. On a machine that already has extensions, docker extension ls prints the references installed, which is the list to read against the ones you intended.
What counts as one edit? One character substituted, inserted or deleted — a Levenshtein distance of one, compared in lower case. tailscal, tailscales and tai1scale are each one edit from tailscale; tailsca1e-vpn is not. For the publisher half the namespace must differ from every listed publisher and be one edit from one of them. For the name half the image name must be within one edit of a listed image name — an identical name counts — under a namespace that is not that listed publisher. Only the first match of each kind is reported, and the finding names the listed reference it matched.
Why is a listed extension never a lookalike? Because it is the original. The check compares an image reference against Docker's marketplace index, and a reference that is in the index returns before any comparison is made. The committed copy of the index is tested to be self-consistent — no listed extension is one edit from another, and no two of the 45 listed publishers are within one edit of each other — so on the marketplace itself the check cannot fire, and in the 18 September 2026 measurement of all 50 it did not.
Why would my own private extension be flagged? Because the marketplace's image names are generic. Six listed extensions are named docker-desktop-extension and five are named docker-extension, so a private image that follows the same convention — acme/docker-extension — is an identical listed name under another namespace, and the name half fires beside the marketplace-listing check's own finding for an image outside the index. The finding says which listed reference it matched; a reader who knows the image is their own can allow it, and the point cost is 18.
D5 Marketplace listing — the finding that always arrives with this one, and the sharpest signal on this platform · V4 Lookalike publisher or name — the same net on the VS Code Marketplace, against a larger and moving list · C4 Fork and lookalike — the GitHub analogue, where the original can be forked as well as imitated · H4 Lookalike organisation — one edit from a known organisation on the Hugging Face Hub.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of all 50 extensions in Docker's marketplace index, run locally through the same code as the API, and the index itself as fetched the same day; Docker Desktop release notes for 4.31.0 and 4.74.0 and the Extensions overview of 21 April 2026, as read on 18 September 2026; weights from the product's scoring table.