dhi.io/postgres
PostgreSQL 14.x (fips, dev)
14-alpine-fips-dev, 14-alpine3.24-fips-dev, 14.17-alpine-fips-dev, 14.17-alpine3.24-fips-dev
sha256:c2d16e3b70e54cb41a72331c7196b1355faed9c1ec26908596d4ca3bb64db4b6
Manifest digest:sha256:08ac12cf061d31030ca5edbbda713ddaf05599a42dde709f95bfe37db4d28028
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/postgres:14-alpine-fips-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/postgres:14-alpine-fips-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/postgres@sha256:fd6a25e73cf20dab5d8f48e5a7d77fc664d53620ba8eba462491cc294a70bed9 |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/postgres@sha256:9b26af9a4ebc5a6d326c15ac901b1e88c0509e979b436cac647ef54ba662801e |
| FIPS compliance v0.1 | https://docker.com/dhi/fips/v0.1 | dhi.io/postgres@sha256:20f3dbf009f39f67368b6e5bb4ad51374def015b79b20d9f223689cf7796d74f |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/postgres@sha256:d0c69c8676f9f08d1686d48599f34d116b379a1229d56c326623dd6ae109c89d |
| STIG scan v0.1 | https://docker.com/dhi/stig/v0.1 | dhi.io/postgres@sha256:84d97dd3592c58b1dfe47eaea89b7ddf3cb189e2ccd0268a384f58c75aee9d20 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/postgres@sha256:95e4b047d059db2724d288ecb823f34f16be8665cc510758a899c751e19932fa |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/postgres@sha256:0aed54744ba9eb841d8c2aab4dc9a0783056171625fe23c3d60b6bb6b499a831 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/postgres@sha256:b922a2a3e3ab724882814b304d9496764c03792e528052cc30530746f63fcfcf |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/postgres@sha256:b3d178526c7a386691faa6fe2569cda14dcc533f5fc660226fbce9b8182775a9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/postgres@sha256:c9cea3aadc644e30adb277608830772ae6f4c6eb062611ce9c48206d12729f1b |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/postgres@sha256:f67acb89ede40fbd97e50cd914116ee3af119beafc031688629dc6f4e98eda01 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/postgres@sha256:1334ea72201c3b12641bef8ef667fa9d988a1c35d98d88ea7e7b5d971f95bd9d |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/postgres@sha256:446bd056f163e49847f88b33e0f4124e33ce5b2a00855bbd4efe384a9d93aef2 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/postgres@sha256:94304b1e8f4e6352128d78f08b74a9651adaf5387398790b5e360fb753fc3a8d |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/postgres@sha256:6ddcc26d9cbbf0a2a6d2e959d8cf5d3151b3d93dddd15c8529c1fa16a6cb7a21 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/postgres@sha256:51e97c763c0ed8e04da0af1f03de3f920af9bd64c95b9bebfe0f838d7a1ac1ca |