dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.22-alpine-sfw-dev, 3.10.22-alpine3.24-sfw-dev
sha256:d0b6a3a7b281860f7d498dec96e8ffbd338694c709895f6b1353022212ffeb3b
Manifest digest:sha256:78e27b937918e2139212a49144f015e94a8571efb3f0e153771df4070787b033
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:44e36bdb4beaa6617ae0a92b468d5c4b69a85a5c6d057517dbb9adfa9f6181fa |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:3880a49d3880a1efbc1579d0f5ab7962d3446a01ae367e79cd7812ef87497f01 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:ee19f8aadeccf63acf21462d8dd285c662c0946f9d6d5760a8f3758dde1d4ea0 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:b8cc4878a0b0fdf64f47f8c9b16eed64c269804307e9c64fbfff919d3367b58a |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:7e6799b7a3d0b5b413400fa05b559d7dfd07759de313bc8fd587cf23c69df357 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:6ea2be65230a31461ec9180ca7403c4a16c91b64eb900a6be0978060f105e8d0 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:a84100fee0e828bd796da1f51c4cb7e018738a9899af98754b2683c769f601fa |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:4b95c46b8d4d96d3d26c1983bd904f21c444de9153304a977055aac463319c50 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:c24032caa418f7564cd0274e4522bd6d6d4d0afced3d24b5aba353b63bc2329f |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:5c8451295b5b35472a6367e1897bf91856ad01480da3f1754ac1a9652575b634 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:1b9aaf192b0582298900e9871e02aa9d3a59c111148c4cafcafacc4b060a972a |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:0461b7791973693698eb8677d676e8c775193176335427abc8788ec1b0e01f45 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:56a5f83d1c3531d287ce8418353a3c45b494543c588b8b6ad39d1e94555fcaba |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:8748b7a7a58a1cf5442cea6ecd467f59b703a3b448ab9bdcf1faba730dab8321 |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:c2cf62a63a22b7aa6d94119783889cf0c77a70a1e75267106020efac8741a69f |