dhi.io/prometheus
Prometheus 3.5.x LTS
3, 3-debian, 3-debian13, 3.5, 3.5-debian, 3.5-debian13, 3.5.5, 3.5.5-debian, 3.5.5-debian13
sha256:61cec0e0c3f7075b37956d97a3ba12a5bbc1d253cf2bb0909ab9a5336f55bbdd
Manifest digest:sha256:9c02840e638bea9da6add4394432582f59ddf38747aa2c3ffcad45ed5703eb1f
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/prometheus:32. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/prometheus:3 --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/prometheus@sha256:bbc83496ce8576a0a56ce22c5d4c4796ce3e1419316bd7d3956522da91ee105c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/prometheus@sha256:cd719f2792e05236a6af9b8ab934f8156b991f04fe9337a20f86e7704da5c673 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/prometheus@sha256:fcd984d60140d29257b45b0b18a2f001605cd422542768f1724a5b6aedd2960d |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/prometheus@sha256:12ec11b36baf0f8e8d270c6fd00dccc66dc3027c5b27c812abd7dca31a6fa4f4 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/prometheus@sha256:0b534ac9ee795f98f2e9a0b87ac84d1e2ce75281f6c03e25a8781e1d4600e624 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/prometheus@sha256:dba77354a2370862e0787db53111b43c485c52dbdc37c69595e93f5ef91ac00d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/prometheus@sha256:830db36aa80443f60e5136638a1a30d3dfa83263ebfcb36414307ad75f97e246 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/prometheus@sha256:4c091bbd5160cadf4c152dad976a04732c61a75f615d6efa4f41a80ff22545ea |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/prometheus@sha256:c9d85f07957eeb45c4a14d4321d218c4b37bf065db45b6f9d5a0ec9f4a510ed9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/prometheus@sha256:78e64ec529b0d660a1f29001766442814baa0a30a10c3ed0b6a61a5f2758fba0 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/prometheus@sha256:1908203cf0ca3fc6a1407f4c2b8513b01220e4a88e3a4054f1be70079b5f4094 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/prometheus@sha256:0e8b8496eb02b9b8fce863fdc4ce3b3d368980204b41c5b0d44e5dac7c55b53c |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/prometheus@sha256:6054f43dcdfbab835a9ac96f7ed224025d7103a1e3d73ca843bdf9507b55c3ac |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/prometheus@sha256:b50ff6ce6a3f6a04be705db087773f3bc03d0ff74b3a2c75e1c5b110cbd6e041 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/prometheus@sha256:06cdf962da23081b786531b217133a735d712b27624244ccba2deda468772753 |