readystack/canvas repository overview

⁠Canvas LMS

readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2

Source, recipe and records

• Source and build recipe: https://readystack.dev/products/canvas/recipe⁠
• Upstream source at this release's pinned commit (release/2026-05-20.143): https://github.com/instructure/canvas-lms/tree/2e2b4a46d08e32667d4845f7b78e1214250345d3⁠
• Product page: https://readystack.dev/products/canvas⁠
• Hermetic Build Kit for this release (free with an account): https://readystack.dev/products/canvas⁠
• Release history (JSON): https://readystack.dev/api/releases/canvas⁠
• Defect record: https://readystack.dev/defects.html?product=canvas⁠
• Today's scan: https://readystack.dev/products/canvas#pp-grade⁠
• Report an issue: https://github.com/ReadyStackFree/readystack/issues/new?template=bug.yml&product=canvas⁠
• Signing key (cosign): https://readystack.dev/keys/cosign.pub⁠

A cosign-signed build of github.com/instructure/canvas-lms release/2026-05-20.143 (commit 2e2b4a46, 2026-04-30; AGPL-3.0, learning management system), built clean-room from official upstream source, with the source changes listed below by ReadyStack⁠.

⁠Who uses it and why

Who: Colleges, universities and schools that run their own learning management system.

Why: Canvas LMS gives each course an online home where instructors publish content and assignments, post announcements, hold discussions and record grades in a gradebook.

Use case: A college moves its courses online. Each course gets a Canvas site where the instructor publishes materials and assignments with due dates, students take part in course discussions, and marks go into a gradebook that shows each learner's progress.

About the upstream project, written from its own description: https://github.com/instructure/canvas-lms⁠ · https://github.com/instructure/canvas-lms/wiki⁠ · https://www.instructure.com/canvas⁠

⁠What you get

Signature, user and attestations below were measured on the published digest sha256:79b1ec971c178dd8c078b5cdb7099b5bb3514f5352c02619a1b3b8b1b4bcaf8c on 2026-10-30.

• Scan scores — we scan every image we publish every day (an SBOM made with syft, vulnerabilities matched with grype, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26) and record each scan with how its score was derived. This release's first and latest scan: https://readystack.dev/products/canvas⁠
• ReadyStack release check — passed at release on 2026-10-29: no fixable critical or high vulnerability (Docker Scout and OSV), a non-root user, SBOM and provenance attached. This is ReadyStack's own test, not a Docker grade; vulnerabilities published since then are in today's result at https://readystack.dev/queue⁠.
• Signed — cosign signature by the ReadyStack release key (fingerprint 04daa92344a52dbc) on this release's index digest sha256:79b1ec971c178dd8c078b5cdb7099b5bb3514f5352c02619a1b3b8b1b4bcaf8c; verify with cosign verify --key https://readystack.dev/keys/cosign.pub readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2.
• Attestations — An SPDX SBOM and SLSA v1 build provenance are attached to this digest.
• Runs as a non-root user (canvas).
• Built from source by ReadyStack.

⁠Which tag should I pull?

This image follows the ReadyStack release-tag convention:

• The current release is 2026-05-20.143-CE-ubuntu24.04-r2 — the release listed at readystack.dev. Release tags use the pattern <upstream-version>-CE-<base-os>-r<N>; the current one is signed, attested (SBOM + provenance), and is provided under the ReadyStack Agreement⁠.

• Earlier release tags (an older version or revision in the same pattern) are superseded. They stay pullable so existing deployments can pin them, but they are no longer re-graded, and fixes appear only in newer releases: move to the current release. For a superseded release's build kit, ask support.

• Release tags never move, so pulling the same tag again never changes the image. To be offered each new release automatically (a new revision r<N+1>, or a new upstream version), use the ReadyStack Renovate preset: https://readystack.dev/updates.html⁠

• Any tag beginning with internal- is an engineering-pipeline artifact published for build observability. It is unsupported, may change or disappear without notice, and must not be used in production.

# ✓ current release
docker pull readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2

# ✗ unsupported (do not pull)
docker pull readystack/canvas:internal-...

This release is signed; verify it with cosign verify --key https://readystack.dev/keys/cosign.pub readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2 (the signature is recorded in the public Sigstore transparency log). Support: [email protected]⁠, as set out in the ReadyStack Agreement⁠.

⁠Deployment

Two containers from this one image, plus your PostgreSQL and Redis, as upstream's own docker-compose runs Canvas (services web and jobs): the web server (default command web: Puma on port 3000, non-root user canvas, uid 9999) and the background job worker (command jobs: script/delayed_job run). Both are required: without the jobs container, notifications, course imports and copies, file and thumbnail processing, grade exports and the scheduled (periodic) jobs are queued in PostgreSQL and never run. No PostgreSQL, Redis, nginx or Passenger inside the image; put your own TLS reverse proxy in front.

Secrets go in env files that only you can read, not on the command line, and passwords that only set up the first start come out of them after setup. Create each file with install -m 600 /dev/null <file>, then write its lines into it with an editor, with your own values (a value typed into a shell stays in its history). Docker reads each line as written: no quotes around a value, no spaces around =.

canvas-db.env:

# First start only: the postgres image reads POSTGRES_PASSWORD only when it initialises its empty volume. You can remove this line after the first start and recreate the db container; the database keeps the password.
POSTGRES_PASSWORD=YOUR_POSTGRES_PASSWORD

canvas.env:

# The same database password as POSTGRES_PASSWORD; both containers need it at every start.
CANVAS_DATABASE_PASSWORD=YOUR_POSTGRES_PASSWORD
# Needed at every start; set it before the first start and never change it.
CANVAS_ENCRYPTION_KEY=YOUR_ENCRYPTION_KEY

canvas-setup.env:

# First start only: the first start creates the administrator (CANVAS_LMS_ADMIN_EMAIL) with CANVAS_LMS_ADMIN_PASSWORD. Remove this line after setup (keep the file) and recreate the web container; the administrator keeps the password.
CANVAS_LMS_ADMIN_PASSWORD=YOUR_ADMIN_PASSWORD

docker network create canvas-net
docker run -d --name db --network canvas-net --restart unless-stopped -e POSTGRES_DB=canvas_production -e POSTGRES_USER=canvas --env-file ./canvas-db.env -v canvas-db:/var/lib/postgresql/data pgvector/pgvector:0.8.3-pg16 postgres -c max_locks_per_transaction=640
docker run -d --name redis --network canvas-net --restart unless-stopped -v canvas-redis:/data redis:7-alpine
until docker exec db pg_isready -U canvas -d canvas_production; do sleep 2; done
docker run -d --name canvas --network canvas-net --restart unless-stopped -p 3000:3000 -e CANVAS_DATABASE_HOST=db --env-file ./canvas.env -e CANVAS_REDIS_URL=redis://redis:6379/0 -e CANVAS_DOMAIN=localhost:3000 -e CANVAS_SSL=false -e [email protected] --env-file ./canvas-setup.env -e 'CANVAS_LMS_ACCOUNT_NAME=Example School' -v canvas-files:/usr/src/app/tmp/files readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2
docker run -d --name canvas-jobs --network canvas-net --restart unless-stopped --no-healthcheck -e CANVAS_DATABASE_HOST=db --env-file ./canvas.env -e CANVAS_REDIS_URL=redis://redis:6379/0 -e CANVAS_DOMAIN=localhost:3000 -e CANVAS_SSL=false -v canvas-files:/usr/src/app/tmp/files readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2 jobs

Replace YOUR_POSTGRES_PASSWORD (the same in canvas-db.env and canvas.env), YOUR_ENCRYPTION_KEY (20 or more characters; keep it) and YOUR_ADMIN_PASSWORD (8 or more characters) in the three env files. The web and jobs containers both read canvas.env; only the web container reads canvas-setup.env, so the administrator's password never reaches the jobs container. The command above serves plain HTTP on localhost (CANVAS_SSL=false); in production set CANVAS_DOMAIN to your public host name, CANVAS_SSL=true and put a TLS reverse proxy in front. The first start prepares the empty database before the web server listens (about 2.5 minutes measured). Measured memory: about 1.5 GB for the web container and 1.3 GB for the jobs container with their defaults. Once the first start has created the administrator, remove the CANVAS_LMS_ADMIN_PASSWORD line from canvas-setup.env (keep the file) and recreate the web container (docker rm -f canvas, then its docker run line again): the setup runs only while the database has no account administrator, so Canvas starts, the administrator keeps the password, and the password is no longer in any container's environment (tested).

⁠Source changes (AGPL)

This software is licensed under the GNU Affero General Public License, and the releases below are built from a modified copy of its source. Each line names a release, what ReadyStack changed and where the diff is published. From 2026-10-27 a release's diff carries every upstream file its build changes, the dependency manifests and lockfiles included, so its complete corresponding source is the upstream tag with that diff applied; the diff of an earlier release carries the source edits its line names, and the dependency files that release's build changed are in its release archive (vendored/). If you let users interact with the server over a network, AGPL-3.0 section 13 asks you to offer them its source; for a release from 2026-10-27 on, a link to its diff and the upstream tag does that.

• 2026-05-20.143-CE-ubuntu24.04-r2 — one line of Gemfile.d/app.rb allows css_parser 3.x (~> 3.3 instead of ~> 2.0) for GHSA-9pmc-p236-855h; full diff at https://readystack.dev/source/canvas/2026-05-20.143/canvas-2026-05-20.143-readystack.patch⁠
• 2026-05-20.143-CE-ubuntu24.04-r1 — one line of Gemfile.d/app.rb allows css_parser 3.x (~> 3.3 instead of ~> 2.0) for GHSA-9pmc-p236-855h; full diff at https://readystack.dev/source/canvas/2026-05-20.143/canvas-2026-05-20.143-readystack.patch⁠

⁠The full ReadyStack Hermetic Build Kit

The complete --network=none build kit for this image — plus admin/DB/API handbooks, the build's validation records, and its build provenance records — is a free download for any registered account at readystack.dev/products/canvas⁠. A clean-room rebuild from this release's archive on an egress-blocked host reproduced its linux/amd64 digest sha256:3535e722ffb3d4e850e8aa266a00beb5f94dada56dea624ea2d3640a5b922163 on 2026-10-29.

— ReadyStack · readystack.dev