thepeoples

Grafana

Dashboards for metrics and logs. AGPL-3.0-only. linux/amd64.

Pin this image by digest.

published Latest tag 13.2.3-tpio.4. Pin by digest. Usage is on this page.

Critical0
High0
Medium0
Low0
Gate passed
Open Usage

Pin by digest

oci.thepeoples.io/hardened/grafana@sha256:ad0eda2dd89ae183ace8ddc38e8854e4e644e6ae9ac3a996f4873a1767d86ceb

Pull:

podman pull oci.thepeoples.io/hardened/grafana@sha256:ad0eda2dd89ae183ace8ddc38e8854e4e644e6ae9ac3a996f4873a1767d86ceb

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/grafana@sha256:ad0eda2dd89ae183ace8ddc38e8854e4e644e6ae9ac3a996f4873a1767d86ceb

Published 2026-10-17T02:58:00Z624.6 MiB compressed

Usage

Checked on ephemeral k3s for this published digest. The dashboard_query_returns_data check passed on ephemeral k3s.

Image pin overlay:

# https://grafana.com/docs/grafana/latest/setup-grafana/installation/helm/
# Official grafana-community chart 13.5.0. Update checks and the image renderer stay off.
# Datasources match the k3s check: Prometheus and Loki. No external endpoints.
replicas: 1
testFramework:
  enabled: false
initChownData:
  enabled: false
imageRenderer:
  enabled: false
downloadDashboards:
  enabled: false
sidecar:
  dashboards:
    enabled: false
  datasources:
    enabled: false
  plugins:
    enabled: false
image:
  registry: oci.thepeoples.io
  repository: hardened/grafana
  tag: "13.2.3-tpio.4"
grafana.ini:
  analytics:
    reporting_enabled: false
    check_for_updates: false
    check_for_plugin_updates: false
datasources:
  datasources.yaml:
    apiVersion: 1
    datasources:
      - name: Prometheus
        type: prometheus
        access: proxy
        url: http://prometheus-server.monitoring.svc:80
        isDefault: true
      - name: Loki
        type: loki
        access: proxy
        url: http://loki.monitoring.svc:3100
helm repo add grafana-community https://grafana-community.github.io/helm-charts
helm upgrade --install grafana grafana-community/grafana --version 13.5.0 \
  --namespace monitoring --create-namespace -f values-hardened.yaml

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/grafana@sha256:ad0eda2dd89ae183ace8ddc38e8854e4e644e6ae9ac3a996f4873a1767d86ceb
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/grafana@sha256:ad0eda2dd89ae183ace8ddc38e8854e4e644e6ae9ac3a996f4873a1767d86ceb

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

Evidence

Publish and rescan reports for each tag. Gate is 0 CRITICAL / 0 HIGH from Trivy and Grype. MEDIUM/LOW are listed; they do not block publish. Remaining-CVE tables live here.

624.6 MiB · 13.2.3-tpio.4 · worst-of Trivy and Grype at publish.

Publication scan reports: Trivy · Grype · gate · Scan index

Corresponding source for 13.2.3-tpio.4 is at /oci/hardened/grafana/13.2.3-tpio.4/source/.

MEDIUM/LOW are best-effort and non-blocking. Remaining counts:

MEDIUM 0LOW 0

Fixed-version availability does not guarantee a compatible fix.

ScannerCVE / IDPackageInstalledSeverityFixed version available

Counts retain scanner gate semantics; the list deduplicates identical package/version records. Different scanner IDs can describe the same advisory.

Back to pull

This image is here as the Dashboards. Depends on Prometheus (dependency), Loki (dependency).

Why this image is connected
Why this image is connectedGrafanaDashboardsPrometheusdependencyLokidependency

Arrow styles

  • depends on
  • Grafana depends on Prometheus as a dependency
  • Grafana depends on Loki as a dependency

Status: published. Platform: linux/amd64.

Available tags and scan history

13.2.3-tpio.4

Digest:

oci.thepeoples.io/hardened/grafana@sha256:ad0eda2dd89ae183ace8ddc38e8854e4e644e6ae9ac3a996f4873a1767d86ceb

Published 2026-10-17T02:58:00Z UTC.

Publication scan reports: Trivy / Grype / gate / OpenVEX

SPDX SBOM · OpenVEX: not present

Corresponding source available at /oci/hardened/grafana/13.2.3-tpio.4/source/, including exact upstream archives, SHA-256 sums, packaging, rebuild recipe and recorded changes.

Scan history for 13.2.3-tpio.4
Scanned (UTC)Kind / gateTrivyGrypeScanner DB versions/dates
2026-10-17T02:41:20Zpublish / passCRITICAL 0HIGH 0MEDIUM 0LOW 0CRITICAL 0HIGH 0MEDIUM 0LOW 0Trivy 0.75.0 / DB {"DownloadedAt": "2026-10-17T02:07:24.331225448Z", "NextUpdate": "2026-10-17T01:13:54.947090202Z", "UpdatedAt": "2026-10-16T01:13:54.947090392Z", "Version": 2} / 2026-10-16T01:13:54.947090392Z; Grype 0.120.1 / schema v6.1.10 / 2026-10-16T06:29:51Z

MEDIUM/LOW are best-effort and non-blocking. Remaining counts:

MEDIUM 0LOW 0

Fixed-version availability does not guarantee a compatible fix.

Remaining MEDIUM/LOW findings (0 distinct scanner/package/version records; 0 with fixed versions available)
ScannerCVE / IDPackageInstalledSeverityFixed version available

Counts retain scanner gate semantics; the list deduplicates identical package/version records. Different scanner IDs can describe the same advisory.

Show 1 older versions

13.2.3-tpio.3

Digest:

oci.thepeoples.io/hardened/grafana@sha256:9a13224ddc92228518e0caf4396cbc1ed2d194f50e839cf821ec65e2dad7e2f4

Published 2026-10-16T11:29:30Z UTC.

Publication scan reports: Trivy / Grype / gate / OpenVEX

SPDX SBOM · OpenVEX: not present

Corresponding source available at /oci/hardened/grafana/13.2.3-tpio.3/source/, including exact upstream archives, SHA-256 sums, packaging, rebuild recipe and recorded changes.

Scan history for 13.2.3-tpio.3
Scanned (UTC)Kind / gateTrivyGrypeScanner DB versions/dates
2026-10-15T17:11:15Zpublish / passCRITICAL 0HIGH 0MEDIUM 0LOW 0CRITICAL 0HIGH 0MEDIUM 0LOW 0Trivy 0.75.0 / DB {"DownloadedAt": "2026-10-15T17:09:25.913806017Z", "NextUpdate": "2026-10-16T13:13:18.204005123Z", "UpdatedAt": "2026-10-15T13:13:18.204005334Z", "Version": 2} / 2026-10-15T13:13:18.204005334Z; Grype 0.120.1 / schema v6.1.10 / 2026-10-15T06:30:36Z

MEDIUM/LOW are best-effort and non-blocking. Remaining counts:

MEDIUM 0LOW 0

Fixed-version availability does not guarantee a compatible fix.

Remaining MEDIUM/LOW findings (0 distinct scanner/package/version records; 0 with fixed versions available)
ScannerCVE / IDPackageInstalledSeverityFixed version available

Counts retain scanner gate semantics; the list deduplicates identical package/version records. Different scanner IDs can describe the same advisory.

Rebuild and licence

Rebuilt from the official upstream tag tarball. The bundled Tempo datasource is official Tempo v3.1.0. The packaged candidate cleared 0 CRITICAL / 0 HIGH.

Licence: AGPL-3.0-only.

Grafana is AGPL-3.0-only. Corresponding source is the official v13.2.3 tag tarball plus the Containerfile, build-plugins.sh, pin-tempo-v3.sh, and plugins.tsv. Docs: https://grafana.com/docs/grafana/latest/

Upstream source