dhi.io/python
Python 3.10.x / Socket Firewall (sfw, dev)
3.10-alpine-sfw-dev, 3.10-alpine3.24-sfw-dev, 3.10.22-alpine-sfw-dev, 3.10.22-alpine3.24-sfw-dev
sha256:e265cacef35e31d368623f98300d4cedf1bb4ad95a6b4c7fcb31aefe6cdc602a
Manifest digest:sha256:58a729ed01c66f1ba2a0ea6448af2dbbb889a5d0b95cc93a03f3169617379ef4
Overview
Docker Hardened Images include comprehensive security attestations that verify the image's build process, contents, and security posture. This image is built using SLSA Build Level 3 practices. Additionally, this image includes a source attestation that links to a corresponding source image containing all build materials. The following attestations are available and can be verified using cosign.
Docker's DHI public key is available at https://registry.scout.docker.com/keyring/dhi/latest.pub and also archived at https://github.com/docker-hardened-images/keyring.
How to verify attestations
1. List all available attestations
docker scout attest list dhi.io/python:3.10-alpine-sfw-dev2. Verify a specific attestation
For example, to verify the SLSA provenance attestation:
docker scout attest get dhi.io/python:3.10-alpine-sfw-dev --predicate-type https://slsa.dev/provenance/v0.2 --verifyAttestations
All attestations are signed and can be verified with cosign.
| Predicate | Predicate type | Reference |
|---|---|---|
| CycloneDX SBOM v1.6 | https://cyclonedx.org/bom/v1.6 | dhi.io/python@sha256:eff78007d9fcaa23ba08e1d368dc28e1bd598a51d1652fd86607f8ec3ed7c48d |
| Changelog v0.1 | https://docker.com/dhi/changelog/v0.1 | dhi.io/python@sha256:964e47684440183212134c46e523d8aa61e7ff8d68c32957fa117325e7ccbbd8 |
| DHI Image Sources v0.1 | https://docker.com/dhi/source/v0.1 | dhi.io/python@sha256:683d08de5c20583d7f4e0a09c80d5dcf3d1a5991f3b383f5d9bfaf6a326a7f53 |
| CVEs v0.2 | https://in-toto.io/attestation/vulns/v0.2 | dhi.io/python@sha256:1e2f9e2568a286f519c0e8c3887b654298323671c7931facfd1ed48dee48e32e |
| VEX v0.2.0 | https://openvex.dev/ns/v0.2.0 | dhi.io/python@sha256:c3a771554470fba944552fab153bc95980810e26d540818f2a49555c54422745 |
| Scout provenance v0.1 | https://scout.docker.com/provenance/v0.1 | dhi.io/python@sha256:5bdb3408a9230aa1989798064682d64ebba17c979873038dd22c861950691ed4 |
| Scout SBOM v0.1 | https://scout.docker.com/sbom/v0.1 | dhi.io/python@sha256:663ce054c17b0821c66efa27ea385c322fd7e83d467a815c1f3dc86dd0d7f12f |
| Secrets scan v0.1 | https://scout.docker.com/secrets/v0.1 | dhi.io/python@sha256:4f1c2ed9c8aadd938d01bb93ef6de1b638024e78b0dd49f6f8dcd5c8b8fcb79a |
| Tests v0.1 | https://scout.docker.com/tests/v0.1 | dhi.io/python@sha256:8ddeb278ae2b07d425741c644741744af72ce18a5adab1c4203966af2ea7d3e9 |
| Virus scan v0.1 | https://scout.docker.com/virus/v0.1 | dhi.io/python@sha256:9ebc946b1d233c6a8da9193fe7ed9d11647141ad49afebbae8125ff8638e0b98 |
| CVEs v0.1 | https://scout.docker.com/vulnerabilities/v0.1 | dhi.io/python@sha256:f02b550c9f846797a19dc2fd938c49b01f7e5ed3efc7fd212c2fa00e25b5ddff |
| SLSA provenance v0.2 | https://slsa.dev/provenance/v0.2 | dhi.io/python@sha256:01f93496a71080ef65ce02cd1e5e7408347086d5a0624e0bd7899f4d37f5593b |
| SLSA provenance v1 | https://slsa.dev/provenance/v1 | dhi.io/python@sha256:b126707f3fdc18736528def04b173bf83521db373e20f84f1e9ddf49bab1a7f2 |
| SLSA verification summary v1 | https://slsa.dev/verification_summary/v1 | dhi.io/python@sha256:9aa939bc99b0d046d1d52668be17124034de9bbeea6791b66fcce58ff2e54ebe |
| SPDX SBOM | https://spdx.dev/Document | dhi.io/python@sha256:ec72ebf61b76807ccd84f944883912472f2dbc72ca92c3f922175777c63f657a |