Hardened container images
22 rebuilt images in the hardened registry, signed by the thepeoples.io platform key. linux/amd64. Pin production by digest. Publish requires 0 CRITICAL and 0 HIGH from both Trivy and Grype at the scan’s database date.
Pin these images in Helm or Kustomize. Verify with cosign before you apply.
Open an image for pull and verify. Usage examples are on each image page. Artwork credits.
This is not FIPS, FedRAMP, STIG, CIS, zero-CVE, or a support contract. Full claim
GitOps and delivery
Argo CD and the Dex, Redis, and HAProxy images it uses. Arrow styles
Ingress and gateway
Traefik and Envoy reverse proxies. Arrow styles
Certificates
The cert-manager family for in-cluster TLS. Arrow styles
cert-managerCertificate manageruses cert-manager webhook (admission), cert-manager cainjector (ca-bundle)- cert-manager webhookAdmission webhookuses cert-manager cainjector (ca-bundle)
- cert-manager cainjectorCA bundle injector
- cert-manager acmesolverACME HTTP-01 solver
- cert-manager startupapicheckStartup API checkuses cert-manager (api), cert-manager webhook (admission)
Secrets
External Secrets Operator.
Observability
Blackbox Exporter. The rest of this family is added as each image is published. Arrow styles
Blackbox ExporterEndpoint probe
Node ExporterHost metrics
PrometheusMetrics collectionuses Alertmanager (alerts), Node Exporter (node), Kube State Metrics (kube-state), Blackbox Exporter (probe), Redis Exporter (redis)
AlertmanagerAlert routing
LokiLog storage
OpenTelemetry CollectorTelemetry pipeline
GrafanaDashboardsuses Prometheus (metrics), Loki (logs)
AlloyLog shippinguses Loki (logs)
Kube State MetricsCluster metrics
Redis ExporterRedis metrics
GitOps and delivery
Argo CD and the Dex, Redis, and HAProxy images it uses.
| Image | Latest | Digest | Worst-of scan | Size |
|---|---|---|---|---|
 Argo CDGitOps continuous delivery control planeApache-2.0 | sha256:11c4a79f…05c1 | Crit0 High0 Med142 Low9 | 201.0 MiB | |
 DexSSO providerApache-2.0 | sha256:29991671…4ba3 | Crit0 High0 Med3 Low0 | 99.5 MiB | |
 RedisHA cacheAGPL-3.0-only | sha256:83b6e027…4145 | Crit0 High0 Med3 Low1 | 36.9 MiB | |
 HAProxyHA cache load balancerGPL-2.0-or-later | sha256:ba110856…1e7e | Crit0 High0 Med3 Low0 | 21.8 MiB |
Ingress and gateway
Traefik and Envoy reverse proxies.
| Image | Latest | Digest | Worst-of scan | Size |
|---|---|---|---|---|
 TraefikIngress proxyMIT | sha256:409042a7…7ef5 | Crit0 High0 Med3 Low0 | 108.0 MiB | |
 EnvoyGateway proxyApache-2.0 | sha256:254f553e…53e0 | Crit0 High0 Med74 Low19 | 80.4 MiB |
Certificates
The cert-manager family for in-cluster TLS.
| Image | Latest | Digest | Worst-of scan | Size |
|---|---|---|---|---|
| cert-managerCertificate managerApache-2.0 | sha256:a72da0d9…5779 | Crit0 High0 Med0 Low3 | 48.7 MiB | |
| cert-manager webhookAdmission webhookApache-2.0 | sha256:5fcfc4c5…c277 | Crit0 High0 Med0 Low3 | 38.7 MiB | |
| cert-manager cainjectorCA bundle injectorApache-2.0 | sha256:59af5ecb…2c52 | Crit0 High0 Med0 Low0 | 23.8 MiB | |
| cert-manager acmesolverACME HTTP-01 solverApache-2.0 | sha256:8c049459…069f | Crit0 High0 Med0 Low0 | 12.2 MiB | |
| cert-manager startupapicheckStartup API checkApache-2.0 | sha256:588256b6…4cfd | Crit0 High0 Med0 Low0 | 22.0 MiB |
Secrets
External Secrets Operator.
| Image | Latest | Digest | Worst-of scan | Size |
|---|---|---|---|---|
 External Secrets OperatorSecret sync operatorApache-2.0 | sha256:f29c67bc…d0cf | Crit0 High0 Med2 Low2 | 151.0 MiB |
Observability
Blackbox Exporter. The rest of this family is added as each image is published.
| Image | Latest | Digest | Worst-of scan | Size |
|---|---|---|---|---|
| Blackbox ExporterEndpoint probeApache-2.0 | sha256:175a6a67…268a | Crit0 High0 Med0 Low0 | 9.2 MiB | |
| Node ExporterHost metricsApache-2.0 | sha256:07fcfe49…291e | Crit0 High0 Med0 Low0 | 6.8 MiB | |
| PrometheusMetrics collectionApache-2.0 | sha256:f8c829d0…9279 | Crit0 High0 Med0 Low0 | 58.9 MiB | |
| AlertmanagerAlert routingApache-2.0 | sha256:013d96b7…e9c9 | Crit0 High0 Med0 Low0 | 21.4 MiB | |
| LokiLog storageAGPL-3.0-only | sha256:dcd7ff87…4f2b | Crit0 High0 Med0 Low0 | 46.8 MiB | |
| OpenTelemetry CollectorTelemetry pipelineApache-2.0 | sha256:4b1a6e46…3afd | Crit0 High0 Med0 Low0 | 51.7 MiB | |
| GrafanaDashboardsAGPL-3.0-only | sha256:ad0eda2d…6ceb | Crit0 High0 Med0 Low0 | 624.6 MiB | |
| AlloyLog shippingApache-2.0 | sha256:35bdbba8…bcf2 | Crit0 High0 Med65 Low7 | 195.6 MiB | |
| Kube State MetricsCluster metricsApache-2.0 | sha256:88be177a…5d9a | Crit0 High0 Med0 Low0 | 37.7 MiB | |
| Redis ExporterRedis metricsMIT | sha256:2eafba4f…7d52 | Crit0 High0 Med0 Low0 | 8.6 MiB |
Further rebuilds planned
New families appear here when they are published. Nothing is listed until it has a signed digest.
| Image | Latest | Digest | Worst-of scan | Size |
|---|---|---|---|---|
| Argo CDGitOps continuous delivery control planeApache-2.0 | sha256:11c4a79f…05c1 | Crit0 High0 Med142 Low9 | 201.0 MiB | |
| DexSSO providerApache-2.0 | sha256:29991671…4ba3 | Crit0 High0 Med3 Low0 | 99.5 MiB | |
| RedisHA cacheAGPL-3.0-only | sha256:83b6e027…4145 | Crit0 High0 Med3 Low1 | 36.9 MiB | |
| HAProxyHA cache load balancerGPL-2.0-or-later | sha256:ba110856…1e7e | Crit0 High0 Med3 Low0 | 21.8 MiB | |
| TraefikIngress proxyMIT | sha256:409042a7…7ef5 | Crit0 High0 Med3 Low0 | 108.0 MiB | |
| EnvoyGateway proxyApache-2.0 | sha256:254f553e…53e0 | Crit0 High0 Med74 Low19 | 80.4 MiB | |
| cert-managerCertificate managerApache-2.0 | sha256:a72da0d9…5779 | Crit0 High0 Med0 Low3 | 48.7 MiB | |
| cert-manager webhookAdmission webhookApache-2.0 | sha256:5fcfc4c5…c277 | Crit0 High0 Med0 Low3 | 38.7 MiB | |
| cert-manager cainjectorCA bundle injectorApache-2.0 | sha256:59af5ecb…2c52 | Crit0 High0 Med0 Low0 | 23.8 MiB | |
| cert-manager acmesolverACME HTTP-01 solverApache-2.0 | sha256:8c049459…069f | Crit0 High0 Med0 Low0 | 12.2 MiB | |
| cert-manager startupapicheckStartup API checkApache-2.0 | sha256:588256b6…4cfd | Crit0 High0 Med0 Low0 | 22.0 MiB | |
| External Secrets OperatorSecret sync operatorApache-2.0 | sha256:f29c67bc…d0cf | Crit0 High0 Med2 Low2 | 151.0 MiB | |
| Blackbox ExporterEndpoint probeApache-2.0 | sha256:175a6a67…268a | Crit0 High0 Med0 Low0 | 9.2 MiB | |
| Node ExporterHost metricsApache-2.0 | sha256:07fcfe49…291e | Crit0 High0 Med0 Low0 | 6.8 MiB | |
| PrometheusMetrics collectionApache-2.0 | sha256:f8c829d0…9279 | Crit0 High0 Med0 Low0 | 58.9 MiB | |
| AlertmanagerAlert routingApache-2.0 | sha256:013d96b7…e9c9 | Crit0 High0 Med0 Low0 | 21.4 MiB | |
| LokiLog storageAGPL-3.0-only | sha256:dcd7ff87…4f2b | Crit0 High0 Med0 Low0 | 46.8 MiB | |
| OpenTelemetry CollectorTelemetry pipelineApache-2.0 | sha256:4b1a6e46…3afd | Crit0 High0 Med0 Low0 | 51.7 MiB | |
| GrafanaDashboardsAGPL-3.0-only | sha256:ad0eda2d…6ceb | Crit0 High0 Med0 Low0 | 624.6 MiB | |
| AlloyLog shippingApache-2.0 | sha256:35bdbba8…bcf2 | Crit0 High0 Med65 Low7 | 195.6 MiB | |
| Kube State MetricsCluster metricsApache-2.0 | sha256:88be177a…5d9a | Crit0 High0 Med0 Low0 | 37.7 MiB | |
| Redis ExporterRedis metricsMIT | sha256:2eafba4f…7d52 | Crit0 High0 Med0 Low0 | 8.6 MiB |
Pull by digest, then verify:
podman pull oci.thepeoples.io/hardened/IMAGE@sha256:DIGESTcosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/IMAGE@sha256:DIGESTRegistry log Grouped page Platform key Verify hub Published catalog
Corresponding source, exact upstream archives and rebuild recipes: Argo CD v3.5.4-tpio.3 · Argo CD v3.5.4-tpio.2 · Argo CD v3.5.4-tpio.1 · Dex v2.46.0-tpio.2 · Dex v2.46.0-tpio.1 · Redis 8.6.4-alpine-tpio.1 · HAProxy 3.3.16-alpine-tpio.1 · Traefik v3.7.14-tpio.1 · Envoy v1.39.3-tpio.1 · cert-manager v1.21.2-tpio.1 · cert-manager webhook v1.21.2-tpio.1 · cert-manager cainjector v1.21.2-tpio.1 · cert-manager acmesolver v1.21.2-tpio.1 · cert-manager startupapicheck v1.21.2-tpio.1 · External Secrets Operator v2.12.0-tpio.1 · Blackbox Exporter v0.29.0-tpio.1 · Node Exporter v1.12.1-tpio.1 · Prometheus v3.15.0-tpio.1 · Alertmanager v0.34.1-tpio.1 · Loki 3.7.8-tpio.1 · OpenTelemetry Collector 0.162.0-tpio.1 · Grafana 13.2.3-tpio.4 · Grafana 13.2.3-tpio.3 · Alloy v1.20.1-tpio.1 · Kube State Metrics v2.20.0-tpio.1 · Redis Exporter v1.93.0-tpio.1.
Validated: chart, k3s and 12 checks.
Claim and availability
Pilot platform: linux/amd64. The claim is limited to CRITICAL/HIGH findings cleared versus the recorded upstream digest at the scan's database date, by the worst-of Trivy and Grype. Publish requires 0 CRITICAL / 0 HIGH from both scanners. MEDIUM/LOW remediation is best-effort and non-blocking; remaining counts, findings and fixed-version availability are tracked per tag on the image pages. Reviewed OpenVEX statements with upstream evidence may qualify Grype findings and are attached when present. Scanners can miss vulnerabilities and future databases can find new ones. This is not a FIPS, FedRAMP, STIG or CIS claim, not a claim of zero CVEs, and not a support contract. Consult the latest scan, including any open finding, before deploying.
Tags follow <upstream-version>-tpio.N; every rebuild increments N. Tags are immutable. Pin production deployments by digest. The producer schedules rescans every six hours; scan history shows actual dates, and pending scans are not a clean result.
Licences and corresponding source
Each image page records that rebuild's licence. Redis 8 is redistributed under AGPLv3. Redis source tarball and the docker-library recipe are upstream references. Redis AGPLv3 corresponding source, exact packaging and rebuild recipes are available from the per-tag source links above.
HAProxy is GPL-2.0-or-later (headers LGPL-2.1). Upstream references include the HAProxy 3.3.16 source tarball, docker-library recipe and Alpine aports. HAProxy GPL corresponding source is available from the per-tag links above. Obtain it by downloading the linked HAProxy source archive, packaging archive and rebuild recipe; verify SHA256SUMS before rebuilding. Base packages retain their own licences. Per-image pages give the licence and remediation details.