Skip to content

Commit cecdc28

Browse files
dhi: add build transparency (#24136)
<!--Delete sections as needed --> ## Description Add transparency benefit to the build conceptual topic. https://deploy-preview-24136--docsdocker.netlify.app/dhi/explore/build-process/ ## Related issues or tickets ENGDOCS-3191 ## Reviews <!-- Notes for reviewers here --> <!-- List applicable reviews (optionally @tag reviewers) --> - [ ] Editorial review - [ ] Product review --------- Signed-off-by: Craig Osterhout <craig.osterhout@docker.com>
1 parent b765b92 commit cecdc28

1 file changed

Lines changed: 19 additions & 0 deletions

File tree

content/manuals/dhi/explore/build-process.md

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,25 @@ both base and customized images is backed by SLA commitments, including a 7-day
1818
SLA for critical and high severity vulnerabilities. Only DHI Enterprise includes
1919
SLAs. DHI Free offers a secure baseline but no guaranteed remediation timelines.
2020

21+
## Build transparency
22+
23+
Docker Hardened Images provide transparency into how images are built through
24+
publicly available definitions and verifiable attestations.
25+
26+
### Image definitions
27+
28+
All image definitions are publicly available in the [catalog
29+
repository](https://github.com/docker-hardened-images/catalog).
30+
31+
Each image definition is a declarative YAML specification that includes metadata,
32+
contents, build pipeline steps, security configurations, and runtime settings.
33+
34+
### SLSA attestations
35+
36+
Every Docker Hardened Image includes a SLSA Build Level 3 attestation that
37+
provides verifiable build provenance. For details on SLSA attestations and how to
38+
verify them, see [SLSA](../core-concepts/slsa.md).
39+
2140
## Build triggers
2241

2342
Builds start automatically. You don't trigger them manually. The system monitors

0 commit comments

Comments
 (0)