dhi.io/envoy
Envoy 1.36.x (fips, dev)
1.36-debian-fips-dev, 1.36-debian13-fips-dev, 1.36-fips-dev, 1.36.11-debian-fips-dev, 1.36.11-debian13-fips-dev, 1.36.11-fips-dev
sha256:c28545212089d9bef33aa046f47b3396474fce38b6f5d7350e55cde56fef75e8
Manifest digest:sha256:ab51410797b807b49cdbac8f02df20f9a3ece3251167b0e2ea80151e3b4e3b32
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/envoy:1.36-debian-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/envoy:1.36-debian-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/envoy@sha256:eba9b10ef27f55fcd75bfb4ebed4f1c6075e8971087e726dd167c0afac1631f1 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/envoy@sha256:84abadfda53a703da37d330ae53f50bca1d18bbb8e1f61ba59f6ee719efd0511 |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/envoy@sha256:92619be352d5a2567e00d2e5f273bd2cf75b846d1345ddab2dad939a478b6bcd |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/envoy@sha256:e20467eb555f2d5f60ad053ff552e08a53319d62cddcaf08ce0b911c7c722a5c |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/envoy@sha256:5ba11ff62005f82eda6868738f1dd84f4611c8b1cb7cdac9fcd8cf502dc93ac4 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/envoy@sha256:4f3898b9a24a0ad50dda94cdbd7e56c3701b0dd8387882289d10fe7910eea07f |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/envoy@sha256:309c3a503f61787ce66f4a214901de36c8cbac3a4aaa02435a4b4bd65c18853f |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/envoy@sha256:341561d012be58e3be15ab23d29e9efe2489a3b8ed37c2421e20e1e16b133aed |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/envoy@sha256:0b3319c76098fe185594b9ad297bb6196b09d86f1489566f333c99ab2eb74697 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/envoy@sha256:20ec869bfa2690f7f793dc20dec460f548ce4bd0e5a49dcd07076948563d0569 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/envoy@sha256:313f6ea3c954022143e385d88836776219a96cf2e4d910585d7f452e98086bf0 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/envoy@sha256:9829fc3d292b8fc87b91abef91bce95275562a17cd81db527184cca930c43570 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/envoy@sha256:640d3f6a3cdbef6d62f0980bf47a8bc6f3ea0a5c20a4c8234753b877b15d53d8 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/envoy@sha256:767c51b7daa93fcdaf889e70cd959a424014d46b01537876e41228e497f4670b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/envoy@sha256:dcfc2c21824c3b67d421816f27f3e9cfe61c80d6b39677d2c53b170e874508d9 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/envoy@sha256:2ce35fce3b112a7d5d95b592ce877d8191ab0b30f4c2275e81fde470b9526dfa |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/envoy@sha256:fef128de593355b80fabbbb3b359a16ec5c195f8163a71900d88637aaf2115fe |