Integration · Containers
Docker + OrchestrAI
Catalog exported 2026-09-02 · Docker website
Build, run, scan, tag, and push Docker images from chat, and browse Docker Hub repositories and tags.
OrchestrAI exposes 15 Docker operations: 8 are low-risk (read-only or low-impact), and 7 create or modify resources and run only after you confirm the plan. 6 of them also carry a step-level approval gate.
What teams use it for
Developers use OrchestrAI to build an image from a Dockerfile, scan it for vulnerabilities, and push it once the scan looks clean, with the push confirmed first. Listing containers and images, reading logs, inspecting, and pulling are low risk, while run, stop, remove, tag, and push wait for your approval. Docker Hub coverage is read-only: listing repositories and their tags. There is no operation for Docker Compose or for deleting a tag from Docker Hub, so handle those on the command line or in Hub.
Every Docker operation, with its risk level
| Operation | What it does | Risk | Step-level approval |
|---|---|---|---|
Docker Inspect |
Inspect a container or image | Low risk | No |
Docker Logs |
Get container logs | Low risk | No |
Docker Pull |
Pull an image from a registry | Low risk | No |
Docker Scan |
Scan image for vulnerabilities | Low risk | No |
List Docker Containers |
List Docker containers | Low risk | No |
List Docker Hub Repositories |
List repositories in the connected Docker Hub namespace | Low risk | No |
List Docker Hub Tags |
List tags for a Docker Hub repository | Low risk | No |
List Docker Images |
List local Docker images | Low risk | No |
Docker Build |
Build a Docker image from a Dockerfile | Creates resources | No |
Docker Push |
Push an image to a registry | Creates resources | Yes |
Docker Run |
Run a Docker container | Creates resources | Yes |
Docker Tag |
Tag a Docker image | Creates resources | Yes |
Remove Docker Container |
Remove a container | Creates resources | Yes |
Remove Docker Image |
Remove a local Docker image | Creates resources | Yes |
Stop Docker Container |
Stop a running container | Creates resources | Yes |
Risk tiers come from the catalog: low is read-only or low-impact, medium creates resources and is reversible, high modifies existing resources, destructive may lose data. Every plan that creates or changes resources is shown with its cost estimate and waits for your confirmation. Operations marked with a step-level approval pause again on their own step. Destructive operations require a typed risk phrase.
What you connect
A Docker credential (stored as docker_hub).
Connected-service tokens are envelope-encrypted with a per-record key wrapped by a cloud KMS.
Prompts that work
- Build the image from ./Dockerfile as api:2026.09.02 and scan it for critical CVEs
- Show the last 200 lines of logs from the container named worker-1
- List the tags for the Docker Hub repository acme/api
Before anything runs
Every mutation shows its plan, cost estimate, and blast radius, then waits for your confirmation. Destructive operations require a typed risk phrase. Credentials are minted per run through OIDC federation and discarded afterward; nothing you create here is invisible later, because every resource lands in the desired-state ledger where drift is detected and can be converged. Details on the security page.
Frequently asked questions
- Does OrchestrAI push Docker images without confirmation?
- No. Pushing to a registry is medium risk and marked for confirmation, so OrchestrAI shows the image and tag and waits for you to approve.
- Can OrchestrAI delete a Docker Hub tag?
- No. Docker Hub operations are limited to listing repositories and tags. Local image removal is available and waits for confirmation.
- How does OrchestrAI authenticate to Docker?
- You add a Docker credential once in the connections screen. It is envelope-encrypted with a per-record key wrapped by a cloud KMS and is only decrypted inside the run that needs it.
Related integrations
Try it on your own account
Connect your cloud read-only and see your resources, drift, and costs before anything runs. $5 minimum to start. Unused credits refunded in your first 14 days.
Unused credits refunded in your first 14 days.