dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.22-alpine-sfw-dev, 3.10.22-alpine3.24-sfw-dev
sha256:3fcf226c57dd531d996426556fc92f2094d71521cbbb3244acc09280e558e2f5
Manifest digest:sha256:03f20c2940a9e1e0679eaac5fa1177eaa944c54ce5b3a2ec8a7501219b50525a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:b3bfdba0ba0c8f9f8d6e02439bcee28db0f3248c122207948a9b4186e108314f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:87c8bb9c8c6fbd8d993b8f0a8f9e1177ac77dedca1d8a60b588216a623d9bdeb |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:01f655a526648dbf95217026cfa7758cc16c6767b79d111a480ef1634326ef86 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:920d8daf69ea9333f3f3e56e96aeb7b7fb7c8fb811d03ea7e5a390b078a9c0f3 |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:800d3d6d343e8fbdece5b5080679b9a89804ec19f19cdefcf6daff8b219fe444 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:d832058a292baed51a0afa20a390cb6f8ffdde8e082a8f0ccf0cb44388d2ed8d |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:584436d51a7f994804fb8db385d37f02efae1fbb85a4be3e6cac45456ca66dc1 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:d41d582e3664c99eddc85333a678385c66b487c17adfdd7acba3140a39220ed0 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:4bb7eeb2a5313cfa322cdfa7ec0072df133cdedaabac8eb344b840c9dd71f2a2 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:fd7b8b76d8f95c460a145a6527aa119550d2951831921cdadcc9278a81c424ef |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:3208c629e63691e5635146e0625b7f3b3582061690a0dce95c8956e247350b1f |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:1a5ecbbd00c8215e0f242fbaa5028be9b6a9998cb009eea4652a73f81b935f32 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:a7c50daea650e8084b3b32fd866509075d46c28a7c4073b6bf0b85f39bbebd63 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:5a0e9a8e61bec03b9a0f0087d14458c94d35c6622de646f747c5577b57e69fd7 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:dbf7859a58e094829de17f85126ddc9881b1de1179d6712a21a94905ce8f9211 |