Dex

OpenID Connect identity provider. Apache-2.0. linux/amd64.

Pin this image next to hardened Argo CD.

published Latest tag v2.46.0-tpio.2. Usage with Argo CD is on the Argo CD page.

Pin by digest

oci.thepeoples.io/hardened/dex@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3

Pull:

podman pull oci.thepeoples.io/hardened/dex@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/dex@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3

Published 2026-10-09T22:05:10Z99.5 MiB compressed

Usage

These image overrides were exercised as part of the full argo/argo-cd 10.10.1 Helm HA install; see the Validated section. Use the complete HA values for the full tested configuration.

global: {image: {repository: oci.thepeoples.io/hardened/argocd, tag: "v3.5.4-tpio.2@sha256:0f0d36559c94d41c544d65c6ead8bd2aa7f29a9d04d9721af9dd29c2558bc2d8"}}
dex: {image: {repository: oci.thepeoples.io/hardened/dex, tag: "v2.46.0-tpio.2@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3"}}
redis: {image: {repository: oci.thepeoples.io/hardened/redis, tag: "8.6.4-alpine-tpio.1@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145"}}
redis-ha:
  image: {repository: oci.thepeoples.io/hardened/redis, tag: "8.6.4-alpine-tpio.1@sha256:83b6e02798f8896d6eddd4f6c977a821ac4fe8a12d0bd886e1db9cb775114145"}
  haproxy: {image: {repository: oci.thepeoples.io/hardened/haproxy, tag: "3.3.16-alpine-tpio.1@sha256:ba110856a084d7a5b9d61325ef6a24928371b3a9b22a37270a53929c5a7c1e7e"}}

---
# Production-oriented Helm values exercised by validate/run.sh together with
# validate/values/ha.yaml and the generated image pins. CI-only overlays live
# in test-env.yaml / test-env-ha.yaml and are not part of the public example.
# Secrets stay placeholders. Turn a metrics block off by setting enabled: false.

# NetworkPolicy objects for every component (chart default is already true).
# https://argo-cd.readthedocs.io/en/stable/operator-manual/ingress/#network-policy
# https://kubernetes.io/docs/concepts/services-networking/network-policies/
global:
  networkPolicy:
    create: true
    defaultDenyIngress: false
  # Soft anti-affinity spreads replicas when the cluster has enough nodes.
  # https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/
  affinity:
    podAntiAffinity: soft
  securityContext:
    runAsNonRoot: true
    seccompProfile:
      type: RuntimeDefault
  # https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
  logging:
    format: json
    level: info

# HA shape from the upstream chart README (without autoscaling).
# https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd#ha-mode-without-autoscaling
# https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/
controller:
  replicas: 1 # only one replica unless sharding is enabled
  # configs.params.controller.sharding.enabled / .replicas to shard clusters
  metrics:
    enabled: true # set false to skip the metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 250m, memory: 256Mi}
    limits: {cpu: 1, memory: 1Gi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

server:
  replicas: 2
  metrics:
    enabled: true # set false to skip the metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 100m, memory: 128Mi}
    limits: {cpu: 500m, memory: 256Mi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

repoServer:
  replicas: 2
  # Parallelism is per-pod; scale replicas before raising the limit.
  # https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/#repo-server
  metrics:
    enabled: true # set false to skip the metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 100m, memory: 128Mi}
    limits: {cpu: 1, memory: 1Gi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

applicationSet:
  replicas: 2
  metrics:
    enabled: true # set false to skip the metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 50m, memory: 64Mi}
    limits: {cpu: 250m, memory: 256Mi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

# Dex telemetry is the metrics listener on container port 5558.
# https://dexidp.io/docs/getting-started/
# https://argo-cd.readthedocs.io/en/stable/operator-manual/metrics/
dex:
  metrics:
    enabled: true # set false to skip the Dex metrics Service
  pdb:
    enabled: true
    minAvailable: 1
  resources:
    requests: {cpu: 10m, memory: 32Mi}
    limits: {cpu: 100m, memory: 128Mi}
  containerSecurityContext:
    runAsNonRoot: true
    readOnlyRootFilesystem: true
    allowPrivilegeEscalation: false
    capabilities: {drop: [ALL]}
    seccompProfile: {type: RuntimeDefault}

configs:
  params:
    # 0 = unlimited per repo-server pod. Prefer more replicas over a huge limit.
    # https://argo-cd.readthedocs.io/en/stable/operator-manual/high_availability/#repo-server
    reposerver.parallelism.limit: "0"
    controller.status.processors: "20"
    controller.operation.processors: "10"

# redis-ha AUTH is on by default; replace the generated secret in production.
# https://github.com/DandyDeveloper/charts/tree/master/charts/redis-ha
# https://redis.io/docs/latest/operate/oss_and_stack/management/security/acl/
# https://redis.io/docs/latest/operate/oss_and_stack/management/persistence/
redis-ha:
  auth: true
  existingSecret: argocd-redis # placeholder; chart job fills this unless you bring your own
  persistentVolume:
    enabled: true
    storageClass: "" # cluster default StorageClass
    size: 8Gi
  exporter:
    enabled: true # set false to skip the redis_exporter sidecar
    # NOT HARDENED: redis_exporter is not on the hardened allowlist yet.
    # Upstream image pinned by digest from oliver006/redis_exporter v1.93.0
    # (multi-arch index; linux/amd64 manifest sha256:eb2b1e93b654fc21bf508e45ec3d17ca55d22db66c6b826750cecc92c0c21e42).
    image: ghcr.io/oliver006/redis_exporter
    tag: "v1.93.0@sha256:6ca518a72f30f7f576ef92963de1b91d3c3f5fd3aeac949f878bfda183587820"
  haproxy:
    metrics:
      enabled: true # set false to skip HAProxy Prometheus metrics
    containerSecurityContext:
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false
      capabilities: {drop: [ALL]}
      seccompProfile: {type: RuntimeDefault}
    # https://www.haproxy.org/download/3.3/doc/management.txt
    resources:
      requests: {cpu: 50m, memory: 64Mi}
      limits: {cpu: 250m, memory: 128Mi}

Standalone example, not validated

The command also works with podman in place of docker.

Prepare dex.yaml with your issuer URL, OAuth2 clients, connector settings and storage. Dex listens on port 5556; for SQLite, use /var/lib/dex/dex.db and make that volume writable by the image user. The config can reference environment variables required by your connector.

docker run --rm -p 127.0.0.1:5556:5556 \
  -v "$PWD/dex.yaml:/etc/dex/config.yaml:ro" -v dex-data:/var/lib/dex \
  --entrypoint /usr/local/bin/dex oci.thepeoples.io/hardened/dex@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3 serve /etc/dex/config.yaml

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/dex@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/dex@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

This image is here as the SSO provider. Used by Argo CD (SSO provider).

Status: published. Platform: linux/amd64.

Available tags and scan history

oci.thepeoples.io/hardened/dex@sha256:29991671646ac11153ba0225fc26b20b237ad432be56cbcaccb7b1e9635f4ba3

oci.thepeoples.io/hardened/dex@sha256:d29c33a9868c203a32ec3f7987325bbe8036d8989d6bcce5147c22a55ae8adca

Rebuild and licence

gomplate v5.2.0 rebuilt with Go 1.26.9 (ladder b) plus an apk upgrade layer (ladder c).

Licence: Apache-2.0.

Dex and gomplate are Apache-2.0 / MIT; Alpine base packages keep their own licenses.

Upstream source