Build your containers images from a trusted source.
CCIs are hardened upstream Docker images.
What does it mean?
We download the same Docker images that you will find in Docker Hub, apply security patches, sign them cryptographically and push them into our registry.
Why is this important?
Because we provide extra-hardened base images for customers to build their applications upon.
This increases the level of security of all your applications.
How difficult is it to use them?
It's as easy as using any other image.
Instead of using an image from the docker hub you just need to use the image from our registry.
In your Dockerfiles, instead of - for example - using this instruction:
You would use:
Hardening images is a time-consuming process.
It takes a considerable amount of time to lint, validate, harden and sign all those images.
We do it, so our customers do not have to do it.
SIGHUP Certified Container Images
are tested against CVEs public lists daily.
In addition, every image is shipped with both a security and a compatibility report so that you and your security teams can have a clear picture of all your container dependencies' status.
Additionally, we sign every image so you can guarantee the origin of the base images.
With SIGHUP Certified Container Images Catalogue, you do not need to worry about building and maintaining secure base images, exporting standard metrics, and monitoring security vulnerabilities.