steveubiera/traefik repository overview

A production runtime image of Traefik built on Docker's Hardened Image of Traefik (distroless: no shell, no package manager, runs as UID 65532), with both supported web-application-firewall plugins already inside the image so nothing is downloaded at start:

Both are fetched by pinned release URL and verified against a recorded SHA-256 before they are copied into the image; the build fails if the checksum disagrees. Base images are pinned by digest.

⁠Platforms

linux/amd64, linux/arm64, published as a single manifest index.

⁠Tags

• <git sha> — every published build, immutable.
• vX.Y.Z — attached only after the build passed vulnerability and secret scanning and both end-to-end WAF test lanes.
• There is no latest. Pull by digest: docker pull steveubiera/traefik@sha256:<digest>.

The same digest is published to ghcr.io/steveubiera/traefik; both registries carry identical bytes.

⁠What is inside, and what is not

• Traefik binary and entrypoint from the base image; USER 65532; ports 80, 443, 8082 (metrics).
• /plugins-local/ with both plugins, /letsencrypt/ pre-created for a non-root ACME store.
• Health check: traefik healthcheck --ping against /etc/traefik/traefik.yml.
• No configuration. Static and dynamic configuration, secrets and certificates are mounted by the deployment; the image is the same for every environment.

⁠Assurance

Built once in CI, scanned (Trivy: vulnerabilities and secrets, HIGH/CRITICAL fail the build), exercised by live end-to-end lanes for each WAF engine, then published by digest. SBOM and provenance are generated at build time.

⁠Notes

This is not an official Traefik image. Traefik is © Traefik Labs, Apache-2.0; the plugins are Apache-2.0 / MIT under their own repositories. Issues with the image itself: open an issue in the source repository.