Check D5 · provenance family · automatic · one of the 11 Docker Desktop checks
The question this check asks: is this image reference one of the 50 that Docker's Extensions Marketplace lists? Not whether Docker reviewed it — that is a different thing, and this page says what it is — but whether owner/name appears in the index that Docker Desktop itself reads when it draws the Marketplace tab.
A Docker Desktop extension is a Docker Hub image with three optional parts: a dashboard tab, a backend service in Docker Desktop's VM and native binaries copied onto the host. Docker's own overview, in the "Security and trust" section it added on 21 April 2026, puts it plainly: "Docker Extensions run with elevated privileges on your host machine. They have direct access to the Docker Engine, can read and write files on your filesystem, and can install and run native binaries." The Marketplace listing is the only gate between an image and that access, and the same section says what lies outside it: "Extensions installed outside the Marketplace have not been reviewed at all."
What the gate is worth is stated here rather than assumed. Docker paused its manual validation of extensions on 9 January 2024; from then on a submission went through an automated check — in the validate page's words, it "checks if the extension's Dockerfile specifies all the required labels and if the metadata file is valid against the JSON schema file" — plus a Docker staff member adding a label. The Marketplace page itself says extensions "are reviewed by Docker, but are not subject to a full security audit." A thin gate; but an unlisted image has been through none of it.
Then, on 16 June 2026, Docker paused new submissions altogether. The notice on docs.docker.com reads: "New submissions to the Docker Extensions Marketplace are paused while Docker reviews Marketplace security. You can still update existing extensions, and private Marketplace extensions are unaffected." No reason and no resume date have been published. The consequence is what makes this the sharpest check on the platform: the index is frozen at 50 entries, nothing new can be listed, and an image reference that is not in it is — by construction, not by inference — sideloaded or private.
Installing one takes two deliberate settings. Since Docker Desktop 4.31.0 (6 June 2024): "By default, only extensions listed in the marketplace can be installed in Docker Desktop. This can be changed in Docker Desktop's settings." Since 4.74.0 (19 May 2026): "Docker Extensions is now disabled by default." A sideloaded install means the user has turned extensions on and marketplace-only off. SensePost had described the path in 2023: "Your extension does not have to be in the Marketplace to be installable. You can simply publish your extension container to a registry." That is still true; it just now needs both doors open, which is why an unlisted image is HIGH and not CRITICAL.
D5 fetches Docker's live index at desktop.docker.com/extensions/marketplace.json — 50 image references, no tags — and compares the extension's owner/name against it, case-insensitively. A match is dde-listed, INFO, no points; the row's own text notes that submissions have been paused since 16 June 2026 so the list is frozen. The evidence note is one word:
"D5; informational"
No match is dde-unlisted, HIGH, 15 points — "installable by image reference only; with submissions paused since 2026-06-16 nothing new can be listed, so this is sideloaded or private":
"D5; not in Docker's marketplace index — with submissions paused since 2026-06-16 the list is frozen, so unlisted means sideloaded or private; the sharpest signal on this platform"
The 15 points are the smaller half of what an unlisted image costs. Four other checks — D1, D6, D7 and D8 — grade their rows on whether the extension is listed and established: in the index, and with a Hub repository at least 90 days old (dde_established_days). In that state the marketplace's ordinary shapes — a host binary, a backend beside the socket, no Hub badge, no source label — are notes. Off the index, the same rows become HIGH, MEDIUM and HIGH. The control run makes the arithmetic visible: library/nginx, a Hub image that is no Docker Desktop extension at all, reads REVIEW 64 — unlisted 15, unverified publisher 15, no source 6 — while the test fixture of an unlisted image from a publisher who joined last month, with a host binary and a socket-mounting backend, reads BLOCK on the org-strict profile and REVIEW on personal-default.
The verdict engine is the one behind all 11 checks: any CRITICAL finding is a BLOCK, any HIGH or MEDIUM finding is a REVIEW, and a report with nothing above INFO is a PASS. The score is separate — 100 minus every fired penalty, floored at zero, green at 80 and above, amber from 50 to 79, red below 50 — so D5 alone reads REVIEW at 85. Profiles decide what the preflight does with that before docker extension install runs: personal-default maps HIGH to warn, an ask; org-strict names dde-unlisted explicitly and maps it to block, a deny. D5 feeds two dimensions, Clone the source (D1–D5, D8, D10) and Install and run (D5–D7, D9), each taking the worst of its checks and reading PASS only when every one of them ran. When the live index cannot be fetched the committed copy answers (backend/policy/dde-marketplace.json, regenerated by tools/dde_index.py); when neither can, D5 and D4 are reported as not checked, never as a verdict.
The one this check produces on purpose is the private extension. Docker's pause notice says private Marketplace extensions are unaffected, and an organisation's internal extension on its own Hub namespace is, to this check, indistinguishable from a sideload: it is not in the index, so it reads HIGH, and on org-strict it is denied. That is why the row's wording is "sideloaded or private" and not anything stronger, and it is stated here rather than hidden. The second is timing: the committed fallback is a snapshot, so for a scan that had to use it, an extension Docker removed from the live index after the last regeneration would still read listed.
On the marketplace as it stands, D5 is a note-taker. Measured 18 September 2026 against all 50 listed extensions: 50 PASS, 0 REVIEW, 0 BLOCK; dde-listed on all 50 and dde-unlisted on none; 21 declare host binaries, 29 a VM backend, 12 of those mount the Docker socket; 39 come from a publisher with no Hub badge; 33 have not been pushed in a year. Every one of the 50 is at least 853 days old on the Hub (median 1,447 days), so every one is listed and established, and every ordinary shape on it is a note. The verdict changes on an image that is not in the frozen index, or whose publisher is new — and that is the case this check exists to name.
Whether Docker's review found anything. A listing records that an image passed label and schema validation and was accepted before the pause; it is not a security audit, in Docker's own words. The Marketplace's own Reviewed and Not reviewed labels — Docker's manual review against its automated path — are not in the index RepoGates reads, and neither is the Hub's verified-publisher badge, which is D1's field and a different thing. Which tag you would get. The index is a list of references without tags. Since 4.77.0 (8 June 2026) Marketplace installs are by pinned manifest digest, "protecting against tag mutation after publication"; a sideloaded owner/name:tag is whatever the tag points at when you install, and D5 does not compare the two. An image on another registry. An extension published to ghcr.io or a private registry is not a Docker Hub image; the preflight answers that it is not a Docker Hub extension and not assessed, an ask, never a guess.
RepoGates assesses a Docker Desktop extension on request — through the API, the MCP server (platform="dde") and the preflight for docker extension install. It does not see an extension installed from Docker Desktop's own Extensions Marketplace tab, which is the app's own fetch; the board inside Docker Desktop is not built, and cannot be — its marketplace is a native window no browser extension sees. The image is never pulled and its code is not read: a PASS means the provenance and the declared install surface are clean, never that the backend or the host binaries were inspected.
The index is a public JSON file, and reading it is the whole check:
curl -s https://desktop.docker.com/extensions/marketplace.json \
| jq -r '(.extensions // .)[]' | grep -ix 'OWNER/NAME'A line back means listed; silence means not. Fifty lines in total, none with a tag. Then read the Hub record the way D2 does, because "listed and established" needs both halves:
curl -s https://hub.docker.com/v2/repositories/OWNER/NAME/ \
| jq '{namespace, name, date_registered, last_updated, pull_count}'Try it on three references. tailscale/docker-extension and docker/disk-usage-extension — the latter the most-pulled listing at 2.4 million — are in the index; library/nginx is not, and RepoGates reads it as REVIEW 64. RepoGates itself answers the same question with the other ten checks folded in: GET /v1/dde/score/OWNER/NAME with a personal API token (Authorization: Bearer rgp1.…), check_repo("OWNER", "NAME", platform="dde") on the MCP server, or simply typing docker extension install OWNER/NAME in Claude Code with the plugin installed, where the preflight answers before the line runs.
Why is an unlisted extension HIGH and not a BLOCK? Because the user has already opened two doors to install it. Since Docker Desktop 4.31.0 (6 June 2024) only Marketplace extensions install unless the marketplace-only setting is turned off, and since 4.74.0 (19 May 2026) extensions are off altogether by default. An unlisted image is therefore a deliberate sideload or a private extension, which Docker's own pause notice says are unaffected — a strong signal, 15 points, but not proof of anything. The org-strict profile maps it to block regardless; personal-default warns.
Does a listing mean Docker reviewed the extension? Not in the sense a security team means. Docker paused its manual validation on 9 January 2024; from then until the June 2026 pause the gate was an automated check that the Dockerfile carries the required labels and that metadata.json matches its schema, plus a staff label. Docker's Marketplace page says extensions are reviewed but not subject to a full security audit. The index RepoGates reads carries no Reviewed label at all — it is a list of 50 image references.
What happens when the index cannot be fetched? The committed copy answers — backend/policy/dde-marketplace.json, regenerated from the live index by tools/dde_index.py, 50 entries as of 18 September 2026. When neither the live index nor the copy can be read, D5 and D4 are reported as not checked, never as a verdict, and the scan is partial: a partial scan is never cached as a PASS.
D4 Lookalike publisher or name — the other thing the same index answers: an unlisted reference one edit from a listed one · D6 Host binaries — a note on a listed extension, HIGH off the index; D5 is the switch · D7 VM backend — the same switch on the backend beside the socket · V11 Marketplace validation — the VS Code Marketplace's own automated gate, and what it is worth.
Add RepoGates to Chrome Pricing
Numbers on this page: the 18 September 2026 measurement of all 50 extensions in Docker's Marketplace index, plus library/nginx as a control; Docker's own documentation and release notes (manual validation paused 9 January 2024; 4.31.0, 6 June 2024; 4.74.0, 19 May 2026; 4.77.0, 8 June 2026; submissions paused 16 June 2026); SensePost, 30 May 2023; weights from the product's scoring table.