mirror of
https://github.com/docker/docs.git
synced 2026-03-27 14:28:47 +07:00
dhi: add build transparency (#24136)
<!--Delete sections as needed --> ## Description Add transparency benefit to the build conceptual topic. https://deploy-preview-24136--docsdocker.netlify.app/dhi/explore/build-process/ ## Related issues or tickets ENGDOCS-3191 ## Reviews <!-- Notes for reviewers here --> <!-- List applicable reviews (optionally @tag reviewers) --> - [ ] Editorial review - [ ] Product review --------- Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
This commit is contained in:
@@ -18,6 +18,25 @@ both base and customized images is backed by SLA commitments, including a 7-day
|
||||
SLA for critical and high severity vulnerabilities. Only DHI Enterprise includes
|
||||
SLAs. DHI Free offers a secure baseline but no guaranteed remediation timelines.
|
||||
|
||||
## Build transparency
|
||||
|
||||
Docker Hardened Images provide transparency into how images are built through
|
||||
publicly available definitions and verifiable attestations.
|
||||
|
||||
### Image definitions
|
||||
|
||||
All image definitions are publicly available in the [catalog
|
||||
repository](https://github.com/docker-hardened-images/catalog).
|
||||
|
||||
Each image definition is a declarative YAML specification that includes metadata,
|
||||
contents, build pipeline steps, security configurations, and runtime settings.
|
||||
|
||||
### SLSA attestations
|
||||
|
||||
Every Docker Hardened Image includes a SLSA Build Level 3 attestation that
|
||||
provides verifiable build provenance. For details on SLSA attestations and how to
|
||||
verify them, see [SLSA](../core-concepts/slsa.md).
|
||||
|
||||
## Build triggers
|
||||
|
||||
Builds start automatically. You don't trigger them manually. The system monitors
|
||||
|
||||
Reference in New Issue
Block a user