Alloy

Ships pod logs to Loki. Apache-2.0. linux/amd64.

Pin this image by digest.

published Latest tag v1.20.1-tpio.1. Pin by digest. Usage is on this page.

Pin by digest

oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2

Pull:

podman pull oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2

Published 2026-10-16T12:33:23Z195.6 MiB compressed

Usage

Checked on ephemeral k3s for this published digest. The alloy_logql check passed on ephemeral k3s.

Image pin overlay:

# https://grafana.com/docs/alloy/latest/set-up/install/kubernetes/
# DaemonSet on the official alloy chart 1.13.1. The config reloader stays off.
# loki.source.kubernetes drops __meta labels, so pod identity is copied first.
# The k3s check read /var/log as root. Production should grant only that read.
configReloader:
  enabled: false
controller:
  type: daemonset
image:
  registry: oci.thepeoples.io
  repository: hardened/alloy
  tag: "v1.20.1-tpio.1"
alloy:
  enableReporting: false
  stabilityLevel: generally-available
  mounts:
    varlog: true
  configMap:
    content: |
      discovery.kubernetes "pods" {
        role = "pod"
      }
      discovery.relabel "pods" {
        targets = discovery.kubernetes.pods.targets
        rule {
          source_labels = ["__meta_kubernetes_namespace"]
          target_label  = "namespace"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_name"]
          target_label  = "pod"
        }
        rule {
          source_labels = ["__meta_kubernetes_pod_container_name"]
          target_label  = "container"
        }
      }
      loki.source.kubernetes "pods" {
        targets    = discovery.relabel.pods.output
        forward_to = [loki.write.local.receiver]
      }
      loki.write "local" {
        endpoint {
          url = "http://loki.monitoring.svc:3100/loki/api/v1/push"
        }
      }

helm repo add grafana https://grafana.github.io/helm-charts
helm upgrade --install alloy grafana/alloy --version 1.13.1 \
  --namespace monitoring --create-namespace -f values-hardened.yaml

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the Log shipping. Depends on Loki (dependency).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/alloy@sha256:35bdbba83eb9c00865086af3284ca94b4393191cc2878a8f5969a511d480bcf2

Rebuild and licence

Rebuilt from the official upstream tag tarball. The packaged candidate cleared 0 CRITICAL / 0 HIGH. The k3s check shipped a pod log into Loki and a LogQL query returned it.

Licence: Apache-2.0.

Alloy is Apache-2.0. Corresponding source is the official v1.20.1 tag tarball plus the Containerfile and build-alloy.sh. Docs: https://grafana.com/docs/alloy/latest/set-up/install/kubernetes/

Upstream source