dhi.io/prometheus
Prometheus 3.5.x LTS (fips)
3-debian-fips, 3-debian13-fips, 3-fips, 3.5-debian-fips, 3.5-debian13-fips, 3.5-fips, 3.5.5-debian-fips, 3.5.5-debian13-fips, 3.5.5-fips
sha256:3751de112082d4c97ececfa1dd4165a343a03c3eab8167883888870c77229451
Manifest digest:sha256:e4f5b0307cea8aa3d40ccef919012c6ab657f2088409970a8a9fb3c7e3d3b8f0
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/prometheus:3-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/prometheus:3-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/prometheus@sha256:8b564053820ca0e88db9aae94fa1fd2814ba04c97930a86fa8b24e72e726b424 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/prometheus@sha256:278819a515d02ac2718f9e52f8a0d84ff0690762f9cf48826c15621d0bfdc7fd |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/prometheus@sha256:980405bd8577ae1f447f637b212ade61ada5d6c9b6af084588b7297595bcebe3 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/prometheus@sha256:0fe117bac440c55506c7166528a9a448b17cacb1e9b896187483687b8e837d4c |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/prometheus@sha256:419589799bfd7e17c75189dd3e4f63d6f973c175e5976a514850ea6108e15f30 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/prometheus@sha256:e3474a8df75d4f5f1ec71fe3baf632666a21ec13c063ace7f9e35be07dc5253d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/prometheus@sha256:027e27b5348aeeaaef2476ccc03ab73cc237dcdde92fac3f9eeab99718d084c1 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/prometheus@sha256:b58cb70d19c3168a7a2f5dedf6f1645e7ff5e670eee21c7ece601c4d5f05c0fc |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/prometheus@sha256:7843164bbe2811aef100fc1d56de4b2a569a5ffd949e99fcc102a9108355a36c |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/prometheus@sha256:f13d42a7b9b1949d40d6ab66aad92b36bc5a7e461d7cb0b150539c3e7405de57 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/prometheus@sha256:c6dfa9eda436352a92d2cc032ae6e37a9794544a97c74e01d8481168e855498f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/prometheus@sha256:592ddc75b70e8d075ad281e8977abe4f0b0966d2add8e15f5a2561abd86e7983 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/prometheus@sha256:2687a18e08e7c68a2eee8ac89fb7b81b7b097d80b2c88fbd709dc4ea733a0c79 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/prometheus@sha256:923221636a6a8dc18a02880efb9652b2253fcdf6730c15d11927a91edfcef5bb |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/prometheus@sha256:ccad0173ffd3dfbae76d585e316f7570fcc59b8346bf274b80726d12813df712 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/prometheus@sha256:e8e2c3dd038fd290f5516742211030567fc3072ab96c57101a914647f5e32215 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/prometheus@sha256:8016ac5c8b1a4744385f19f3241d4d9ec53f0ee7aaffd9898508f3a779218a06 |