readystack/opensearch repository overview

⁠OpenSearch

readystack/opensearch:3.9.0-CE-ubuntu24.04-r6

Source, recipe and records

• Source and build recipe: https://readystack.dev/products/opensearch/recipe⁠
• Upstream source at this release's pinned commit (3.9.0): https://github.com/opensearch-project/OpenSearch/tree/4ee42a94e87f66fbf1e62a9871b1b87f91e02472⁠
• Product page: https://readystack.dev/products/opensearch⁠
• Hermetic Build Kit for this release (free with an account): https://readystack.dev/products/opensearch⁠
• Release history (JSON): https://readystack.dev/api/releases/opensearch⁠
• Defect record: https://readystack.dev/defects.html?product=opensearch⁠
• Today's scan: https://readystack.dev/products/opensearch#pp-grade⁠
• Report an issue: https://github.com/ReadyStackFree/readystack/issues/new?template=bug.yml&product=opensearch⁠
• Signing key (cosign): https://readystack.dev/keys/cosign.pub⁠

A cosign-signed build of github.com/opensearch-project/OpenSearch 3.9.0 (Apache-2.0 — the OSS fork of Elasticsearch), repackaged clean-room from upstream's prebuilt release artifact by ReadyStack⁠.

⁠Who uses it and why

Who: Developers and operations teams who need full-text search, log analytics or vector search over large amounts of data.

Why: OpenSearch is an open-source search and analytics suite for full-text search, application monitoring, log analytics and vector search, with OpenSearch Dashboards for visualisation and management.

Use case: An online store wants full-text search across its product catalogue. It indexes the catalogue in OpenSearch and sends shoppers' queries there; the same cluster also stores the shop's application logs, which the operations team explores in OpenSearch Dashboards.

About the upstream project, written from its own description: https://github.com/opensearch-project/OpenSearch⁠ · https://docs.opensearch.org/latest/about/⁠

⁠What you get

Signature, user and attestations below were measured on the published digest sha256:d6c4be09922155bf2c3ce3af345d2dc3ee3474ffea047c2b9a6a1620e3e0e14b on 2026-11-13.

• Scan scores — we scan every image we publish every day (an SBOM made with syft, vulnerabilities matched with grype, scored with cerodeo-v2, ce.rodeo's current rubric; scans before 2026-11-08 used cerodeo-v1) and record each scan with how its score was derived. This release's first and latest scan: https://readystack.dev/products/opensearch⁠
• ReadyStack release check — passed at release on 2026-11-13: no fixable critical or high vulnerability (Docker Scout and OSV), a non-root user, SBOM and provenance attached. This is ReadyStack's own test, not a Docker grade; vulnerabilities published since then are in today's result at https://readystack.dev/queue⁠.
• Signed — cosign signature by the ReadyStack release key (fingerprint 04daa92344a52dbc) on this release's index digest sha256:d6c4be09922155bf2c3ce3af345d2dc3ee3474ffea047c2b9a6a1620e3e0e14b; verify with cosign verify --key https://readystack.dev/keys/cosign.pub readystack/opensearch:3.9.0-CE-ubuntu24.04-r6.
• Attestations — An SPDX SBOM and SLSA v1 build provenance are attached to this digest.
• Runs as a non-root user (opensearch).
• Repackaged from upstream's prebuilt release by ReadyStack (https://artifacts.opensearch.org/releases/bundle/opensearch/3.9.0/opensearch-3.9.0-linux-x64.tar.gz⁠, sha256 f52702238e4c…); this build compiles none of upstream's code.

⁠Which tag should I pull?

This image follows the ReadyStack release-tag convention:

• The current release is 3.9.0-CE-ubuntu24.04-r6 — the release listed at readystack.dev. Release tags use the pattern <upstream-version>-CE-<base-os>-r<N>; the current one is signed, attested (SBOM + provenance), and is provided under the ReadyStack Agreement⁠.

• Earlier release tags (an older version or revision in the same pattern) are superseded. They stay pullable so existing deployments can pin them, but they are no longer re-graded, and fixes appear only in newer releases: move to the current release. For a superseded release's build kit, ask support.

• Release tags never move, so pulling the same tag again never changes the image. To be offered each new release automatically (a new revision r<N+1>, or a new upstream version), use the ReadyStack Renovate preset: https://readystack.dev/updates.html⁠

• Any tag beginning with internal- is an engineering-pipeline artifact published for build observability. It is unsupported, may change or disappear without notice, and must not be used in production.

# ✓ current release
docker pull readystack/opensearch:3.9.0-CE-ubuntu24.04-r6

# ✗ unsupported (do not pull)
docker pull readystack/opensearch:internal-...

This release is signed; verify it with cosign verify --key https://readystack.dev/keys/cosign.pub readystack/opensearch:3.9.0-CE-ubuntu24.04-r6 (the signature is recorded in the public Sigstore transparency log). Support: [email protected]⁠, as set out in the ReadyStack Agreement⁠.

⁠Deployment

Single container, JVM (system OpenJDK 21) search + analytics engine, foreground bin/opensearch. HTTP REST API on :9200, transport on :9300. Indices persist under /opt/opensearch/data. NO SQL DB, NO sidecar (single-node). This is the OpenSearch ENGINE only (OpenSearch Dashboards is a separate product). The lean CE image drops the bundled JDK (uses our dist-upgraded system OpenJDK 21), the two heavy security/security-analytics plugins and the k-NN plugin's nmslib engine library (upstream's build of it needs AVX-512). k-NN vector search uses the faiss engine (the default) or the lucene engine; OpenSearch 3.x itself refuses new nmslib indexes.

docker run -d --name opensearch -p 9200:9200 -p 9300:9300 -v opensearch-data:/opt/opensearch/data readystack/opensearch:3.9.0-CE-ubuntu24.04-r6

⁠The full ReadyStack Hermetic Build Kit

The complete --network=none build kit for this image — plus admin/DB/API handbooks, the build's validation records, and its build provenance records — is a free download for any registered account at readystack.dev/products/opensearch⁠. A clean-room rebuild from this release's archive on an egress-blocked host reproduced its linux/amd64 digest sha256:687be85440a39fb230685387295a5d3735424681d0d6349bcf4aaa64c587e47e on 2026-11-13.

— ReadyStack · readystack.dev