dhi.io/postgres
PostgreSQL 14.x (dev)
14-alpine-dev, 14-alpine3.24-dev, 14.17-alpine-dev, 14.17-alpine3.24-dev
sha256:9cc9948d14ab90e2893f07c3be3929e20dd904caae6c2dfc25f1f60e7f7d198f
Manifest digest:sha256:5dca3522a32d220150ae6b25f7607f3a72db48365b09646c86fdd3a43bb341cd
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:8dd817cc1e221a9bae51ac2386dd7a71ceea53731a76254ad73809137b54b73c |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:ab7121e7c93df0ce9d28ea521ce572ab17f7326d911a7946163a64afcadb4159 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:559aeb436b203dee49abab19367f28ff11c84ecbc6ebc904ee9f36e2e33c11e9 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:ad458d4a783cc6b258e0c9e4d8d71dce7dca4bcba05989f275e62baa33a89af6 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/postgres@sha256:6625ee760a8dd4f881880e13e63893aa8d088bf19ee4928d9e6296c56b066984 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:e1cf38f51b611faf1517d72cca8b35d4e23b86316cf33ad5d2473aec7a384ab0 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:e02da3b54da015f9e3c65660c0f2eeaca937635e14bdb23f7db29415e9d9d903 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:af56a431a4a191b1a6b9d66b86a87b7abf2fb3fca9612e124297b22e99ee8b34 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:f9b99ba12536f4f7f684d8933acfb18139e2f97c6e941be271eba71a38a86e7f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:50eab9c35946e38a8dcc0c3434318752a7ac100d049e1c980a7f44d96218eca1 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:9c0680666f061a8585e4a088621828227ba632e76fd3b9c6b02542bdd113fbed |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:951e55237b51a82351de068fef1e7fa4f41092ada89af799d92d0ae2bcabb405 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:76c53c65ab1d84720dac4377854daba9652dc464ab1e7971b5effff30ab14fe2 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:7717089da9ae9b628705d3f3dfae2ed8a688a73fd7536e06550724faa50ef646 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:68d286756219646bdceb69b8b011c515751767dfb45f92390951b7f6affb573b |