libredevops/toolbox repository overview

⁠libredevops/toolbox

Every tool above in one image, for ease. Part of Libre DevOps Container Images⁠: thin, hardened, version-pinned images for CI jobs and tooling, built on Docker Hardened Images, scanned before and after publishing, and signed. Every tag has the same digest here and in GHCR (ghcr.io/libre-devops/toolbox).

⁠Tags

Every version also has a date tag (for example 1-20261107) that is never overwritten. Images are multi-platform (linux/amd64 and linux/arm64) and run as uid 10001 in /work.

⁠Use

docker pull docker.io/libredevops/toolbox:1
docker run --rm -v "$PWD:/work" docker.io/libredevops/toolbox:1

⁠Verify

cosign verify docker.io/libredevops/toolbox:1 \
  --certificate-identity https://github.com/libre-devops/container-images/.github/workflows/release.yml@refs/heads/main \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

⁠Documentation

Usage in GitHub Actions, GitLab CI, Azure DevOps, Podman and Kubernetes; adding a CA bundle; pinning; the security model; and troubleshooting: https://github.com/libre-devops/container-images#readme⁠. Report vulnerabilities privately: https://github.com/libre-devops/container-images/security⁠.