jfxs/image-factory repository overview

⁠Docker Image Factory

A toolkit to automatically sign, update and publish Docker images. It contains a reusable GitLab CI component⁠ and a specific Docker image with useful tools:

• cosign,
• curl,
• docker,
• docker-pushrm,
• git,
• jq,
• skopeo,
• syft,
• task.

The image is also automatically signed, updated and published:

• lightweight image based on Alpine,
• multiarch with support of amd64 and arm64,
• automatically kept up to date by Renovate (base image, Docker, and tool packages),
• image signed with Cosign⁠,
• an SBOM attestation added using Syft⁠,
• available on Docker Hub and Quay.io.

The main repository.

The Docker Hub registry.

The Quay.io registry.

⁠Built with

Docker latest tag is 29.8.2-001, 29.8, 29⁠.

The complete software bill of materials (SBOM) of each published image, with its known vulnerabilities, is collected in the sbom-docker⁠ repository, under the component image-factory.

Dockerhub Overview page⁠ has the details of the last published image.

⁠Versioning

Every publication pushes four tags pointing to the same image digest:

<docker_version>-<increment>    Example: 29.6.2-003
<docker_major>.<docker_minor>   Example: 29.6
<docker_major>                  Example: 29
latest

The increment differentiates builds sharing the same Docker version.

⁠Signature and attestation

Cosign⁠ public key:

-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEa3yV6+yd/l4zh/tfT6Tx+zn0dhy3
BhFqSad1norLeKSCN2MILv4fZ9GA6ODOlJOw+7vzUvzZVr9IXnxEdjoWJw==
-----END PUBLIC KEY-----

The public key is also available online: https://gitlab.com/op_so/docker/cosign-public-key/-/raw/main/cosign.pub⁠.

To verify an image:

cosign verify --key cosign.pub $IMAGE_URI

To verify and get the SBOM attestation:

cosign verify-attestation --key cosign.pub --type spdxjson $IMAGE_URI | jq '.payload | @base64d | fromjson | .predicate'

⁠Authors

• FX Soubirou - Initial work - GitLab repositories⁠

⁠License

This program is free software: you can redistribute it and/or modify it under the terms of the MIT License (MIT). See the LICENSE⁠ for details.