dhi.io/prometheus
Prometheus 3.5.x LTS (fips)
3-debian-fips, 3-debian13-fips, 3-fips, 3.5-debian-fips, 3.5-debian13-fips, 3.5-fips, 3.5.5-debian-fips, 3.5.5-debian13-fips, 3.5.5-fips
sha256:757f3defb858bbe74bb665094307d4db3e328ff700bcf26b8790e175d7117cbe
Manifest digest:sha256:e72fb163465049c25211311507f82460eb5ccb929150473f3d69a8cec7648102
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/prometheus:3-debian-fips2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/prometheus:3-debian-fips --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/prometheus@sha256:1b8e8faf197e7cb488268ab872d860dd78aa54802be2370c539a7ecbd4173c6f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/prometheus@sha256:8c81f0c0aeec0ccbe0428bfc53e4029defe008459ba3fa0e103388d19fe61cbe |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/prometheus@sha256:8a7d347e64841217625093432ad72e47502d4d53cf43bd8c78161de71935ef79 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/prometheus@sha256:3841954d3e71b78e92e092bb7f58dbb01603d7ba6d9d85026169f701d8547d0a |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/prometheus@sha256:929f06760d97dfe4e8acb492c8e8e49a8efa6f3df184a65471c7e02066c3b0b5 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/prometheus@sha256:0072bf019d0628e8c191a8e40013862733caa3a5c777addab70a7d838b5a5f29 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/prometheus@sha256:7a73885b298429b06b6a1121459be6b5e6fadaec30cf8617bf112a6e8ab634ff |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/prometheus@sha256:f74ce1012ff27b1c02f89d6aad4de97c9ccbf90e6df6c635aeda9f272fe3ca34 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/prometheus@sha256:c50222a1e6f841c029c7ceb7d5f3d762a0680af2ba811bb40eabab21b36017b6 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/prometheus@sha256:d8898e46fb23de771e86d26f26a40424450fcf5b55e24a5496d21ede1123d803 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/prometheus@sha256:327ee8c99ac2a5ace87c163127ce86158a9dc411cd7237b4418e19c3a6c86750 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/prometheus@sha256:ecfdc47b1feebce4af4fb79e5f483e9ec1d966e00a1fd21951095918e10e5a15 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/prometheus@sha256:e709d02d5285d1143313fa33b6f067e6a4d19129d2ccfa1e4513c1097c75b01f |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/prometheus@sha256:bfc7fe949c644ea0abe52c95919f1b5fa4043f6fdaa7122a22ac2b3bdd0feb7f |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/prometheus@sha256:41509177493965782eb2988711ae7f4b3afabc2f613da52e88d0e8b245807b96 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/prometheus@sha256:25839800576ab2681683a51b65961d41389fa907bc35203bb82f5b75002fc414 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/prometheus@sha256:5bdea2012d5f53a58c4ea3b879e753cfc2b8afe00be0f2f52a7d26edca0ec86c |