readystack/kubernetesvmstack repository overview

⁠Kubernetes VM Stack

readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2

Source, recipe and records

• Source and build recipe: https://readystack.dev/products/kubernetesvmstack/recipe⁠
• Upstream source at this release's pinned commit (v1.36.6): https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976⁠
• Product page: https://readystack.dev/products/kubernetesvmstack⁠
• Hermetic Build Kit for this release (free with an account): https://readystack.dev/products/kubernetesvmstack⁠
• Release history (JSON): https://readystack.dev/api/releases/kubernetesvmstack⁠
• Defect record: https://readystack.dev/defects.html?product=kubernetesvmstack⁠
• Today's scan: https://readystack.dev/products/kubernetesvmstack#pp-grade⁠
• Report an issue: https://github.com/ReadyStackFree/readystack/issues/new?template=bug.yml&product=kubernetesvmstack⁠
• Signing key (cosign): https://readystack.dev/keys/cosign.pub⁠
• The Kubernetes VM Stack, its parts and its test record: https://readystack.dev/stacks/kubernetes-vm-stack⁠

A cosign-signed build of ReadyStack's install bundle for kubeadm v1.36.6 and KubeVirt v1.9.1, with the upstream release manifests it carries (KubeVirt v1.9.1's operator manifest and custom resource, flannel v0.28.10's kube-flannel.yml, Multus v4.3.1's thin DaemonSet, kubeadm's kube-proxy DaemonSet, a kube-vip v1.3.1 pod manifest), each pinned in the bundle's kubevirt-stack.json; all Apache-2.0, assembled clean-room, with its one program compiled from the kit by ReadyStack⁠.

⁠Who uses it and why

Who: Teams that run a fleet of virtual machines on their own hardware and want them managed beside their containers.

Why: Kubernetes with KubeVirt adds virtual machines to the Kubernetes API: one API and one set of manifests for virtual machines and containers, on the same cluster and nodes.

Use case: A team has applications that still need full virtual machines and new services built as containers. On one Kubernetes cluster with KubeVirt they create, start, stop and migrate the virtual machines through the same Kubernetes API as their pods, and can move the VM workloads into containers over time.

About the upstream project, written from its own description: https://kubevirt.io/⁠ · https://kubevirt.io/user-guide/⁠ · https://github.com/kubevirt/kubevirt⁠ · https://kubernetes.io/docs/concepts/overview/⁠

⁠What you get

Signature, user and attestations below were measured on the published digest sha256:77f9bea6f9789f38057c0ad4b3572145b3076ba89410dc852c62328ea9ad15d1 on 2026-10-29.

• Scan scores — we scan every image we publish every day (an SBOM made with syft, vulnerabilities matched with grype, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26) and record each scan with how its score was derived. This release's first and latest scan: https://readystack.dev/products/kubernetesvmstack⁠
• ReadyStack release check — passed at release on 2026-10-29: no fixable critical or high vulnerability (Docker Scout and OSV), a non-root user, SBOM and provenance attached. This is ReadyStack's own test, not a Docker grade; vulnerabilities published since then are in today's result at https://readystack.dev/queue⁠.
• Signed — cosign signature by the ReadyStack release key (fingerprint 04daa92344a52dbc) on this release's index digest sha256:77f9bea6f9789f38057c0ad4b3572145b3076ba89410dc852c62328ea9ad15d1; verify with cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2.
• Attestations — An SPDX SBOM and SLSA v1 build provenance are attached to this digest.
• Runs as a non-root user (65534:65534).
• Assembled by ReadyStack: the stack's install bundle, every file listed with its sha256, and one program (stack-bundle) compiled from the kit; none of upstream's code is compiled into this image.

⁠Which tag should I pull?

This image follows the ReadyStack release-tag convention:

• The current release is v1.36.6-kubevirt1.9.1-CE-scratch-r2 — the release listed at readystack.dev. Release tags use the pattern <upstream-version>-CE-<base-os>-r<N>; the current one is signed, attested (SBOM + provenance), and is provided under the ReadyStack Agreement⁠.

• Earlier release tags (an older version or revision in the same pattern) are superseded. They stay pullable so existing deployments can pin them, but they are no longer re-graded, and fixes appear only in newer releases: move to the current release. For a superseded release's build kit, ask support.

• Release tags never move, so pulling the same tag again never changes the image. To be offered each new release automatically (a new revision r<N+1>, or a new upstream version), use the ReadyStack Renovate preset: https://readystack.dev/updates.html⁠

• Any tag beginning with internal- is an engineering-pipeline artifact published for build observability. It is unsupported, may change or disappear without notice, and must not be used in production.

# ✓ current release
docker pull readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2

# ✗ unsupported (do not pull)
docker pull readystack/kubernetesvmstack:internal-...

This release is signed; verify it with cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2 (the signature is recorded in the public Sigstore transparency log). Support: [email protected]⁠, as set out in the ReadyStack Agreement⁠.

⁠Deployment

Not a service: the image's filesystem is the bundle. Take it out with docker create and docker cp :/kubernetesvmstack, then follow install/README.md; the operator runbook is runbook/RUNBOOK.md in the bundle, the same text as docs/admin-guide/ADMIN_HANDBOOK.md in the build kit; each image the stack installs is its own product.

This image runs no service: it holds the stack's install bundle. docker run --rm --network none readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2 checks every file against SHA256SUMS and prints a line ending files verified (VERIFY_OFFLINE.sh runs the same check). docker create --name kvs readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2 && docker cp kvs:/kubernetesvmstack ./kubernetesvmstack && docker rm kvs copies the bundle out.

⁠The full ReadyStack Hermetic Build Kit

The complete --network=none build kit for this image — plus admin/DB/API handbooks, the build's validation records, and its build provenance records — is a free download for any registered account at readystack.dev/products/kubernetesvmstack⁠. A clean-room rebuild from this release's archive on an egress-blocked host reproduced its linux/amd64 digest sha256:0268790dadac6fbc392784cb7f77f996526f4d1b6394bb30228d19ddaae062e9 on 2026-10-29.

— ReadyStack · readystack.dev