dhi.io/envoy
Envoy 1.36.x (fips, dev)
1.36-debian-fips-dev, 1.36-debian13-fips-dev, 1.36-fips-dev, 1.36.10-debian-fips-dev, 1.36.10-debian13-fips-dev, 1.36.10-fips-dev
sha256:0841ed0d858c4273c16fb4e5da12e1b6b804f1cc4ffedc46669b09973ba983aa
Manifest digest:sha256:62b29174c70048425933fa28b7deaf40b082e2597f9bb153bbe72df5e44a60c5
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/envoy:1.36-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/envoy:1.36-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/envoy@sha256:07c9719ffe40cade61b2704eab042d5c5cc1d339a9de0bbbeb592fa156640e72 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/envoy@sha256:92a0f2dce24f76dad7f9a87f1e39547ebe80ba1254f563b59bc2613b94360f30 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/envoy@sha256:5e1e1966f55d1be84751fcdbc0e4b779f4861e22c02a242b0f73319b95bdca5e |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/envoy@sha256:c0e81d1361a6fc7796d578989d31f4d800e5cff7a4d15c532fad02a4e223a6b6 |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/envoy@sha256:3bba99832c8cb982a00e681eaf2c514e3af7a2844fa2a16877de59aa2124a600 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/envoy@sha256:25fc117ba91d3a2be9bb0deb885de5e258c5e77942e354cb9ea46da422f1a44e |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/envoy@sha256:01c24cfcca497a5a082ac0bc087260fb5a1fa00348cf70294d5e6575a8377544 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/envoy@sha256:36fd955a3c6de5f73d380e84a40ea2b17ca9e60246eebedda4c31e8afc780e16 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/envoy@sha256:a86e25a43a77653be7b93cd183dd5fba4c933376f773d4ea4fc3e206c6895349 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/envoy@sha256:0a2b533d246fa344db95ba86df0ed88bd28bc45458f060162640242e5cd20163 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/envoy@sha256:292569946ac3f233295c3a92af19d7647f4a8d60def25fe47a9bfdca312d6792 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/envoy@sha256:e4d68f7fb9428a77cee3057c9c403348c234c0887897eb36cda09bba868bf6fd |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/envoy@sha256:f0e1c4b0d439734f41019c28a23234ac264d21bc1d9e0fc6f9ec1dcbcf1aac80 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/envoy@sha256:b2a517381ebef2f7917cd338c0896826763d025656d36f575b805b4e9899a87c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/envoy@sha256:3e656a3a721d0625e03ef066b798ce54198b3710dfa361795b64fa0cbd47f022 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/envoy@sha256:096e4b2be6180d14d3fed3db067dc87ec74e1e6cfad658be2b95926b147fbee3 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/envoy@sha256:9349e410251651dff6ec2a686e2b68e8da60fa92d6ca37714ea112103c9b60c9 |