Initializ Secure Images is a collection of container images designed for security.
All these images are built using apko and melange. These tools provide a reproducible, declarative approach to building OCI images.
Our images are available via public.ecr.aws.
For example, to pull the kubectl image with Docker:
docker pull public.ecr.aws/t4s8c0c3/kubectl:latest These images contain stand-alone software, databases, web servers, and tools like kubectl and aws-cli.
Because our images are constantly rebuilt with the latest sources and include the absolute minimum of dependencies, they typically have significantly fewer vulnerabilities than equivalent images.
For example:
All Initializ Secure Images are signed using Sigstore, and you can check the signature using cosign. For our kubectl image example, you can run the following:
cosign verify public.ecr.aws/t4s8c0c3/kubectl \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ --certificate-identity https://github.com/initializ/secure-images/.github/workflows/release.yml@refs/heads/main \ | jq Your output will make sure that the cosign claims are validated.
All Initializ Secure Images come with a Software Bill Of Materials (SBOM) generated at build-time. The SBOM can be downloaded using the cosign tool e.g.:
cosign download attestation \ --predicate-type https://spdx.dev/Document \ public.ecr.aws/t4s8c0c3/kubectl | jq -r .payload | base64 -d | jq You will see the following result:
{ { "_type": "https://in-toto.io/Statement/v0.1", "predicateType": "https://spdx.dev/Document", "subject": [ { "name": "public.ecr.aws/t4s8c0c3/kubectl", "digest": { "sha256": "6f932665bebaa373c5eb3bb150222137e6037142f238f06f464237ef26211778" } } ], "predicate": { "SPDXID": "SPDXRef-DOCUMENT", "creationInfo": { "created": "2023-10-18T18:17:54Z", "creators": [ "Tool: apko (c419221)", "Organization: Chainguard, Inc" ], "licenseListVersion": "3.16" }, "dataLicense": "CC0-1.0", "documentDescribes": [ "SPDXRef-Package-sha256-9bf86620a4ea8a1ec0a6cc3501ef415daf6bbf4d7e7257a0749cddd9cd20a187" ], "documentNamespace": "https://spdx.org/spdxdocs/apko/", "files": [ ... TESTING