About ReadyStack

ReadyStack is a project to automate a pain.

The pain

Packaging open-source software as an image people can actually run and trust is hard. Keeping it that way never stops:

• Upstream ships. Every new release has to be packaged again.
• The base moves. Base images age, and new CVEs land in packages that scanned clean last week.
• Rebuild. From the source, pinned base images and pinned dependencies, with the network off, then check whether it reproduces the published digest.
• Document. Admin and database handbooks checked against the exact image, plus seed data and tests for each release’s use cases.
• Check. License, scans, signature, attestations and the offline rebuild before release; scans and a grade again every day.
• Sign and re-release. Then do it all again, forever.

The objective

Release and improve, perpetually. Image automation — improving forever. Automated continuous reconciliation and verification harnesses package, test, document and sign each release, on repeat. Every release is scanned again daily, and one that falls below grade A is flagged for a rebuild.

Free, and soon a nonprofit

ReadyStack does not charge for recipes or build kits; we only ask people to sign up. The images on Docker Hub are free, and every release's pinned recipe and Hermetic Build Kit download free with an account.

ReadyStack is soon to be a nonprofit. Anyone who wants to take part can email [email protected].

Help

Contributions of any sort are welcome: bug reports, fixes, documentation, product requests. Open them on our public issue tracker, on ReadyStack's GitHub; anything else, or anything private, to [email protected] (security reports: security.txt). Known problems are in the defect log; what we are building is in the build queue.