Prometheus

Metrics collection and alerting evaluation. Apache-2.0. linux/amd64.

Pin this image by digest.

published Latest tag v3.15.0-tpio.1. Pin by digest. Usage is on this page.

Critical0

High0

Medium0

Low0

Gate passed

Open Usage

Pin by digest

oci.thepeoples.io/hardened/prometheus@sha256:f8c829d00ae3279be237c9f47fae6576a88d94da740112885953f4c1038a9279

Pull:

podman pull oci.thepeoples.io/hardened/prometheus@sha256:f8c829d00ae3279be237c9f47fae6576a88d94da740112885953f4c1038a9279

Verify:

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/prometheus@sha256:f8c829d00ae3279be237c9f47fae6576a88d94da740112885953f4c1038a9279

Published 2026-10-16T05:04:18Z58.9 MiB compressed

Usage

Checked on ephemeral k3s for this published digest. The prometheus_self_up check passed on ephemeral k3s.

Image pin overlay:

# https://prometheus.io/docs/prometheus/latest/configuration/configuration/
# Native OTLP receiver for the Collector. Install Alertmanager and the
# exporters as their own releases, so the bundled subcharts stay off.
server:
  image:
    repository: oci.thepeoples.io/hardened/prometheus
    tag: "v3.15.0-tpio.1"
  extraArgs:
    web.enable-otlp-receiver: null
alertmanager: {enabled: false}
kube-state-metrics: {enabled: false}
prometheus-node-exporter: {enabled: false}
prometheus-pushgateway: {enabled: false}
configmapReload:
  prometheus: {enabled: false}

helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm upgrade --install prometheus prometheus-community/prometheus --version 29.36.1 \
  --namespace monitoring --create-namespace -f values-hardened.yaml

Verify the latest published digest

cosign verify --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog oci.thepeoples.io/hardened/prometheus@sha256:f8c829d00ae3279be237c9f47fae6576a88d94da740112885953f4c1038a9279
cosign verify-attestation --key https://thepeoples.io/keys/oci.thepeoples.io.pub --insecure-ignore-tlog --type https://thepeoples.io/attestations/hardened-gate/v1 oci.thepeoples.io/hardened/prometheus@sha256:f8c829d00ae3279be237c9f47fae6576a88d94da740112885953f4c1038a9279

The report views show the predicate types and commands for SPDX, scanner and optional OpenVEX attestations. Inspect the verified predicates as well as the signature.

Evidence

Publish and rescan reports for each tag. Gate is 0 CRITICAL / 0 HIGH from Trivy and Grype. MEDIUM/LOW are listed; they do not block publish. Remaining-CVE tables live here.

58.9 MiB · v3.15.0-tpio.1 · worst-of Trivy and Grype at publish.

Publication scan reports: Trivy · Grype · gate · Scan index

Corresponding source for v3.15.0-tpio.1 is at /oci/hardened/prometheus/v3.15.0-tpio.1/source/.

MEDIUM/LOW are best-effort and non-blocking. Remaining counts:

MEDIUM 0LOW 0

Fixed-version availability does not guarantee a compatible fix.

Scanner	CVE / ID	Package	Installed	Severity	Fixed version available

Counts retain scanner gate semantics; the list deduplicates identical package/version records. Different scanner IDs can describe the same advisory.

Back to pull

This image is here as the Metrics collection. Used by Grafana (metrics). Depends on Alertmanager (dependency), Node Exporter (dependency), Kube State Metrics (dependency), Blackbox Exporter (dependency), Redis Exporter (dependency).

Why this image is connected

Arrow styles

uses
depends on

Grafana uses Prometheus as metrics
Prometheus depends on Alertmanager as a dependency
Prometheus depends on Node Exporter as a dependency
Prometheus depends on Kube State Metrics as a dependency
Prometheus depends on Blackbox Exporter as a dependency
Prometheus depends on Redis Exporter as a dependency

Status: published. Platform: linux/amd64.

Available tags and scan history

v3.15.0-tpio.1

Digest:

oci.thepeoples.io/hardened/prometheus@sha256:f8c829d00ae3279be237c9f47fae6576a88d94da740112885953f4c1038a9279

Published 2026-10-16T05:04:18Z UTC.

Publication scan reports: Trivy / Grype / gate / OpenVEX

SPDX SBOM · OpenVEX: not present

Corresponding source available at /oci/hardened/prometheus/v3.15.0-tpio.1/source/, including exact upstream archives, SHA-256 sums, packaging, rebuild recipe and recorded changes.

Scan history for v3.15.0-tpio.1
Scanned (UTC)	Kind / gate	Trivy	Grype	Scanner DB versions/dates
2026-10-15T16:38:16Z	publish / pass	CRITICAL 0HIGH 0MEDIUM 0LOW 0	CRITICAL 0HIGH 0MEDIUM 0LOW 0	Trivy 0.75.0 / DB {"DownloadedAt": "2026-10-15T16:36:27.005593107Z", "NextUpdate": "2026-10-16T13:13:18.204005123Z", "UpdatedAt": "2026-10-15T13:13:18.204005334Z", "Version": 2} / 2026-10-15T13:13:18.204005334Z; Grype 0.120.1 / schema v6.1.10 / 2026-10-15T06:30:36Z

MEDIUM/LOW are best-effort and non-blocking. Remaining counts:

MEDIUM 0LOW 0

Fixed-version availability does not guarantee a compatible fix.

Remaining MEDIUM/LOW findings (0 distinct scanner/package/version records; 0 with fixed versions available)

Scanner	CVE / ID	Package	Installed	Severity	Fixed version available

Counts retain scanner gate semantics; the list deduplicates identical package/version records. Different scanner IDs can describe the same advisory.

Rebuild and licence

Rebuilt from the official upstream tag tarball. The packaged candidate cleared 0 CRITICAL / 0 HIGH.

Licence: Apache-2.0.

Prometheus is Apache-2.0. Corresponding source is the official v3.15.0 tag tarball plus the Containerfile and rebuild script. Docs: https://prometheus.io/docs/prometheus/latest/getting_started/

Upstream source