dhi.io/netbox
NetBox
NetBox is the open-source network infrastructure source of truth — IPAM and DCIM in one Django application.
pushed 1 day ago
linux/amd64, linux/arm64
120.79 MB
for linux/amd64
245
for linux/amd64
Active support
-
Build Level 3
Tamper-evident proof of how and from what sources this image was built. Build Level 3 is the highest the SLSA build track defines.
CycloneDX SBOM + SPDX SBOM
A software bill of materials in both CycloneDX and SPDX formats so it drops straight into your existing tooling. Audit exactly what you're shipping.
A Vulnerability Exploitability exchange document, Docker's assessment of which CVEs actually affect this image and which don't apply, so you can focus on real risk instead of chasing false positives.
Available
A link to everything used to build the image, package source code, Git repos, and build files, so you can audit or reproduce the build and stay compliant with open source licenses.
Every known vulnerability in this image, shown in full rather than hidden. The VEX data flags which ones actually apply, so you can tell real exposure from noise before you ship.
Exactly what changed in this build, down to the package bumps and fixes behind the version you're pulling.
Verifies no keys, tokens, or credentials were accidentally baked into the image.
The image layers were scanned for known malware signatures before publishing.
About NetBox
NetBox is the open-source source of truth for network infrastructure. It combines IP address management (IPAM) and data center infrastructure management (DCIM) into a single Django web application — modeling devices, racks, cables, VLANs, prefixes, IPs, circuits, virtualization, tenancy, and contacts. NetBox exposes REST and GraphQL APIs that let network automation pipelines query and mutate the model programmatically, and ships a custom-script and webhook system for in-tool automation. It is the canonical inventory and topology store for thousands of production network operators.
About this image
This image packages the NetBox web tier, the Django application served by the
Granian ASGI/WSGI server, for production deployment. The same image runs
in two roles via the cmd override:
- web (default):
granianserving the NetBox UI and API on port 8080. - worker:
python manage.py rqworkerfor the background task queue.
NetBox 4.6 deprecated the standalone manage.py housekeeping command upstream, so it is not exposed as a separate mode
here.
Customers provide the runtime data stores: PostgreSQL (canonical state) and two Redis instances (the primary with append-only persistence for the RQ queue + a separate cache instance). See the guides for a complete compose example.
Variants
This image ships four variants on debian-13:
- runtime — the default; runs as nonroot uid 65532 and contains only the NetBox venv + Django app + the Granian server + the minimal C libraries needed to run.
- dev — runtime plus
aptand standard build utilities, runs as root, for installing NetBox plugins via the recommended multi-stage Dockerfile pattern (see guides). - fips — runtime variant with OpenSSL configured to load the FIPS provider; Python's
ssl/hashliband the C libs (libxmlsec1, libxslt1.1, libpq5, libldap) all run through it. Carriesfips-compliant: true+stig-certified: trueattestations (OpenSCAP attestation generated automatically in CI). - fips-dev — fips variant with the dev overlay applied (apt + bash + coreutils + findutils, runs as root).
SAML + FIPS caveat
NetBox supports SAML 2.0 single sign-on via python3-saml, which uses xmlsec for XML signature verification. In the
FIPS variants, xmlsec runs under the FIPS OpenSSL provider — non-FIPS hash algorithms (MD5 and some legacy uses of
SHA-1) are disabled. Most modern identity providers default to SHA-256 signing and work transparently; customers whose
IdP still signs with SHA-1 will see verification failures and need to update the IdP before adopting the FIPS variant.
About Docker Hardened Images
Docker Hardened Images are built to meet the highest security and compliance standards. They provide a trusted foundation for containerized workloads by incorporating security best practices from the start.
Why use Docker Hardened Images?
These images are published with near-zero known CVEs, include signed provenance, and come with a complete Software Bill of Materials (SBOM) and VEX metadata. They're designed to secure your software supply chain while fitting seamlessly into existing Docker workflows.
Trademarks
All third-party product names, logos, and trademarks are the property of their respective owners and are used solely for identification. Docker claims no interest in those marks, and no affiliation, sponsorship, or endorsement is implied.