Agent-ready Community Edition Images
Free open-source images with handbooks checked against the exact image, tested seed data, and an offline rebuild archive. Built for engineers and their AI agents.
The network is off.
The bytes still match.
Rebuild from the archive with --network=none. Releases verified reproducible rebuild to the identical linux/amd64 image-manifest digest we published.
--network=none, nothing fetchedBuild SLSA 3 Images on Your Infrastructure.
Each kit is the complete, pinned build of one release. Run it on your own hardened build platform, sign the SLSA v1 provenance BuildKit generates, and you reach SLSA Build Level 3 without engineering the build yourself. We are the shortcut; your platform supplies the hardening and the signing key.
$ ./BUILD_OFFLINE.sh --provenance # --network=none · SLSA v1 provenance from BuildKit $ ./VERIFY_OFFLINE.sh ==> DIGEST MATCH # then sign the provenance with your own key
Defects our checks found
Open the defect logBefore a release ships, independent review rounds check its handbooks and records against the exact image, and clean-room rebuilds check its archive. What they find is logged in our public defect log, with what happened to it. A running count, live from the log:
Don't trust us. Rebuild it yourself.
What a match looks like$ ./BUILD_OFFLINE.sh # --network=none, nothing fetched $ ./VERIFY_OFFLINE.sh published : sha256:7e229b55c116501a7c00b78a1eba91ca… rebuilt : sha256:7e229b55c116501a7c00b78a1eba91ca… ==> DIGEST MATCH — reproduces the published image bit-for-bit.
How we count: a release counts only when our latest record shows it rebuilt from its sale archive with the archive's own scripts and the network off, to the identical linux/amd64 digest. Each product page gives the date of that rebuild, or says it has not been re-verified.
What that takes
How the build works- Every basePinned by digest
- Every timestampFrozen
- The whole toolchainVendored
- Left to varyNothing
- Live Docker Hub tagAdd
--onlineto prove it holds that digest
Docker Hub image
FreeOpen source images, free to pull.
- Community Edition (CE), open source only
- Documented build process
- Addressed by SHA-256 digest
- Base OS named in every release tag
- Each release's grade, with the date and why
Whether a release is signed, runs as non-root and carries SBOM and provenance attestations is shown per release on its product page, as read from the registry.
ReadyStack Agent-ready Archive
Per productEverything to verify, rebuild, and operate.
Offline rebuild archive, full documentation, seed data, validated tests, defect reports, and provenance records — per product.
Dockerfile.offlineBUILD_RECIPE.jsonCHECKSUMS.sha256SBOM.jsonVERIFY.mdREBUILD.mdbases/imagesvendored/source
- Admin handbook
- DB handbook
- API guide
- Seed data
- Security report
- Defects report
- Validation tests
- Release notes
ReadyAssets trustless design
How a release is built today$ ./BUILD_OFFLINE.sh # docker build --network=none $ ./VERIFY_OFFLINE.sh
$ docker buildx build --network=none \ --attest type=provenance,mode=max --attest type=sbom $ cosign sign --key readystack.key readystack/<slug>@sha256:…
Self documenting
Into ReadyAssetsWhat ships in the Agent-ready Archive
Real excerpts from WordPress 7.1.2What verifying looks like
From the release notes# inside the unpacked archive $ sha256sum -c CHECKSUMS.sha256 $ ./BUILD_OFFLINE.sh && ./VERIFY_OFFLINE.sh --online $ cosign verify --key https://readystack.dev/keys/cosign.pub \ readystack/wordpress:7.1.2-CE-debian-bookworm-r1 # every signature is recorded in the public Sigstore transparency log
Custom packaging services
Need an agent-ready, attested bundle for an open source project we haven't built yet? We'll build it, test it, document it, and deliver the full ReadyStack Agent-ready Archive.