dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.22-alpine-sfw-dev, 3.10.22-alpine3.24-sfw-dev
sha256:ccbae9ca071a2c7bc0bb19983db3d3dbe791c73a4db44ee1898eefdc5e696a61
Manifest digest:sha256:1d5933cd0db5b3cc69d49cdaedc5c9f988b37afa8ec923ff2b440a2d3cefef9a
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:c9b6ec840fd49e4fc28ad18cd07a8f4679295aa1e1946af8d18148cd6b63c412 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:7384a95153f138052488e2bcf1ce0e60b994af3b41698a8c91e68c93d3612edc |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:07a8317c75980ae7dedd6f969a16bb91a8ca8b589ede6c0a6b7d0a9bf9da9b7c |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:4d708761ddb39a577acaa9d182eea0d65a6313aa6cb1e48e1021deeef324368d |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:a32d6264c47e1688ece74c8cc0e1b927079b57f9904c10be97d5cb5bfd432171 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:70a0b516711901af56a190a5c9cfefa38233fdbf0a6b46e03c83dd4e877b2c1f |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:fa9b8df1488309d4d7e843f3d3d89dbe4ac33dc21472ab97eb32b44b654156f2 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:d6f7e9fffb35304fb14f43a124e12b8c6bd71f21c7ea413df4fa4678716f4f6f |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:2bf1edfd289dc2ce9d2122edf6157f23078b3402ced3338fac0ee373dbb23d0c |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:eddbf00c10f3fe197e6d99622cb69fc3d56ceb7302a7e4168c5aabc2cb25c073 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:e89359044f3f3dc54ffb94d5e70b443beed9ccdf61569521565ef299e8dd7696 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:eaa09b54aa3320c673f730f8452bd93880659c87236d483478fba1e675dec1f7 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:89aa819c9062059140c653d1d46559b1696ef902933f7551d1fc36e7d6e9ce36 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:68e7f766e236c4a6197e6bbaf366f7025e0b140a5d157b7f45d21797bc9858c9 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:d631deeca337c961b5627b8e00f685198e8f46f856c3ca74aa90bca03874b5b4 |