cleanstart/cadvisor repository overview

Verified CADVISOR Container Image

A hardened, minimal CADVISOR container image built from source with verifiable software provenance and an SBOM, designed for secure production deployments.

For additional versions including FIPS support, explore CleanStart Images — secure, hardened container images⁠

Pull Latest Image Download the container image from the registry

docker pull cleanstart/cadvisor:latest
docker pull cleanstart/cadvisor:latest-dev

Basic Run Run the container with basic configuration

docker run -d --name cadvisor -v /:/rootfs:ro -v /var/run:/var/run:ro -v /sys:/sys:ro -v /var/lib/docker/:/var/lib/docker:ro -v /dev/disk/:/dev/disk:ro -p 8080:8080 cleanstart/cadvisor:latest

Production Deployment Deploy with production security settings

docker run -d --name cadvisor-prod \
  --read-only \
  --security-opt=no-new-privileges \
  --user 1000:1000 \
  -v /:/rootfs:ro \
  -v /var/run:/var/run:ro \
  -v /sys:/sys:ro \
  -v /var/lib/docker/:/var/lib/docker:ro \
  -v /dev/disk/:/dev/disk:ro \
  -p 8080:8080 \
  cleanstart/cadvisor:latest

Volume Mount Mount required system directories for monitoring

docker run -d -v /:/rootfs:ro -v /var/run:/var/run:ro -v /sys:/sys:ro cleanstart/cadvisor:latest

Port Forwarding Run with metrics endpoint exposed

docker run -d -p 8080:8080 cleanstart/cadvisor:latest

Why Use CleanStart Images⁠

• Verified — Built from source with verifiable software provenance
• Hardened — Minimal software footprint designed for secure deployment
• Transparent — SBOM available for visibility into image contents
• Production-ready — Built for modern container environments