dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.21-alpine-sfw-dev, 3.10.21-alpine3.24-sfw-dev
sha256:35d1ed5d0be4dd71df148e062c783294557dcf6ee74c2066dcd49f163f50820d
Manifest digest:sha256:3ec35b546956aeccb673b6432bbdce0b2667a19f40f1b95fd723f1b6964ffdcb
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:a2bff61547ef8c9ccb3d01fb6f32b773d2deecc1db230e4b3918925dd8731a6f |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:4b73240f4bdfeeaecae89f11866c01562f7b94ae6642dc1b214cf051ec04b06c |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:616f976b34a0c3ded2b6d62c959a796950e8b5d38b0dd881f805d8e00c613a84 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:8e674295f31367f48d0de187f230d68fb040f76229e40fe57d14f4675c3509e3 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:f49097a7a991247db34407fb66343485cfc79db4b33b2fb8d7661416d523a51e |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:d50a9c5625ed5b1c879fe76398d71ed38da340464ec4e8b8f445edd5277f1618 |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:10a86ccd5c8014c6099df45bfa9253c01acc0532b07922e885b6cf07649aa7b9 |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:2f0ce77403a6ccec7110892be60085740a3c890fab16468e2b6d7773ce249d48 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:bc06a1a1c5a630c287cd586d45676e088497dced8638113c099c45f1bf7cb40e |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:186fcd092cbfb9a203f17a0d229f4c4dd2798da64330c9fbfbd4c9e21b18d680 |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:350466a6a068b852e367b72ab0ef9850aae599c356f9b29f65cd014caca94302 |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:b3d4b26765dfded4e18eb341b71a5f385c288bd9d8569ad77bc48b020a9d627f |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:56b81cc1d591631525a503c15d03b62e01c3549bccf366f791f7a39b2f3aa48f |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:045ef062f2b6b2df38f25b1e203cef43a8b5dc990729c6ef055f0ca1df934179 |