{"slug":"docker","tag":"29.9.2-CE-ubuntu24.04-r3","current":true,"account":false,"tarball":"ReadyStack-docker-29.9.2-CE-ubuntu24.04-r3.tar.gz","tarball_sha256":"b81d1e1b9f7e80edcda8d89ef9c2e86b54544de9ccabd241cb7063c3c7103c38","generated_at":"2026-10-29T19:34:16Z","dockerfile":"Dockerfile.offline.pinned","build_script":"BUILD_OFFLINE.sh","pins":{"upstream":{"repo":"https://github.com/moby/moby","ref":"docker-v29.9.2","commit":"0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c","url":"https://github.com/moby/moby/tree/0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c"},"components":[{"repo":"https://github.com/docker/cli","ref":"v29.9.2","commit":"a82e528901260c8df6073311379eac65f92db204","name":"cli","url":"https://github.com/docker/cli/tree/a82e528901260c8df6073311379eac65f92db204"},{"repo":"https://github.com/containerd/containerd","ref":"v2.4.2","commit":"b7a25261e029d68978bbf290df0a62fc819b3c51","name":"containerd","url":"https://github.com/containerd/containerd/tree/b7a25261e029d68978bbf290df0a62fc819b3c51"},{"repo":"https://github.com/opencontainers/runc","ref":"v1.5.2","commit":"29dd3dc2b13b4123162e5fe132504bb4b15569f1","name":"runc","url":"https://github.com/opencontainers/runc/tree/29dd3dc2b13b4123162e5fe132504bb4b15569f1"},{"repo":"https://github.com/rootless-containers/rootlesskit","ref":"v3.3.0","commit":"888c3189e9cdf34dcdb19011e1c7c34eb94b5393","name":"rootlesskit","url":"https://github.com/rootless-containers/rootlesskit/tree/888c3189e9cdf34dcdb19011e1c7c34eb94b5393"}],"fetches":[{"kind":"git","url":"https://github.com/moby/moby.git","ref":"docker-v29.9.2"}],"bases":[{"image":"golang:1.26.10-bookworm","digest":"sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af"},{"image":"ubuntu:24.04","digest":"sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c"}],"toolchain":{"buildkit":"moby/buildkit:v0.31.2","buildkit_image_digest":"sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0","builder_images":["golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af"]},"build_method":"source-rebuild-go","source_date_epoch":1792515187,"source_date_epoch_utc":"2026-10-20T16:53:07Z","target":{"image":"readystack/docker:29.9.2-CE-ubuntu24.04-r3","image_manifest_digest":"sha256:f97b1b29d0c0da6df421b790650defe2e2f890540092bc44def0d166398d429b","config_digest":"sha256:2f3f6efccec99247420b7bdd4509ef0ae4a9bc9c8142cfefade5e7e97818a743"},"checksummed_files":40511},"files":[{"path":"BASES.tsv","size":264,"sha256":"8d72027e2bc448d0c7ff3a900bfe648f1e4c9ec92a2beaa3f623ccffc48641b5","public":"full","lines":2,"url":"/api/recipe/docker/29.9.2-CE-ubuntu24.04-r3/files/BASES.tsv","text":"golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af\tbases/golang_1.26.10-bookworm_632dff735179.oci\nubuntu:24.04@sha256:24737cef17f4e22b1977df7d9a05e77c4e28b7da5b8911f8d8ccda136bf3573c\tbases/ubuntu_24.04_24737cef17f4.oci\n"},{"path":"BUILD_OFFLINE.sh","size":6738,"sha256":"83299978ccd02a0b69e163d760da1211b401bbfa35a3184ca674dc37ff876732","public":"preview","lines":125,"preview":{"text":"#!/usr/bin/env bash\n# =============================================================================\n# ReadyStack — offline reproducible rebuild.\n#\n# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access\n# of any kind, and prints the resulting linux/amd64 image-manifest digest.\n# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.\n#\n# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.\n# No git, no registry access, no additional tooling.\n#\n#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)\n#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI\n#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,\n#                                     isolated build platform and sign that provenance with a key the build cannot\n#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image\n#                                     digest is the same either way.\n# =============================================================================\nset -euo pipefail\nPROVENANCE=0\nfor arg in \"$@\"; do\n  case \"$arg\" in\n    --provenance) PROVENANCE=1 ;;\n    -h|--help) sed -n '2,20p' \"$0\"; exit 0 ;;","lines_shown":24,"lines_total":125}},{"path":"CHECKSUMS.sha256","size":6024540,"sha256":"77a213fffacbc3650517dc5f9e792d542b012faff95ff1b21b448f4cb4966845","public":"account","lines":40511},{"path":"DOCKERFILE_NAME.txt","size":26,"sha256":"9aadd1ede68e016a6f163c97befc5ff2fcdc8ebd4f84b108dba63cb195fa8c84","public":"full","lines":1,"url":"/api/recipe/docker/29.9.2-CE-ubuntu24.04-r3/files/DOCKERFILE_NAME.txt","text":"Dockerfile.offline.pinned\n"},{"path":"Dockerfile","size":11563,"sha256":"5fe479221d097f475c0351ff842466287644b5c10715df08f4e5301a10a508ea","public":"account","lines":152,"redactions":[{"line":123,"kind":"internal host"}],"kit_sha256":"7b051329e492499a3d17b7331409700f0d50f2b4a3f6da9f87a11c709bade9b6"},{"path":"Dockerfile.offline","size":11563,"sha256":"5fe479221d097f475c0351ff842466287644b5c10715df08f4e5301a10a508ea","public":"account","lines":152,"redactions":[{"line":123,"kind":"internal host"}],"kit_sha256":"7b051329e492499a3d17b7331409700f0d50f2b4a3f6da9f87a11c709bade9b6"},{"path":"Dockerfile.offline.pinned","size":11563,"sha256":"5fe479221d097f475c0351ff842466287644b5c10715df08f4e5301a10a508ea","public":"preview","lines":152,"redactions":[{"line":123,"kind":"internal host"}],"kit_sha256":"7b051329e492499a3d17b7331409700f0d50f2b4a3f6da9f87a11c709bade9b6","preview":{"text":"# =====================================================================\n# Docker Engine 29.9.2 (rootless Docker-in-Docker) L-009 HERMETIC OFFLINE BUILD — the canonical, attestation-producing\n# build. build_kit runs\n#   docker buildx build --builder readystack-builder-max --network=none\n#     --attest type=provenance,mode=max --attest type=sbom --push <git-context>\n# Pinned-public-base + vendored model: golang 1.26.10 + ubuntu 24.04 pinned BY DIGEST (BASE_IMAGE_DIGESTS.lock);\n# vendored/*-src are fully vendored Go trees (GOPROXY=off, -mod=vendor), every Go program in the image compiled here on\n# the one pinned Go (the toolchain upstream's 29.9.2 bundle reports: go1.26.10); vendored/debs is the apt closure.\n# Dockerfile and Dockerfile.offline are byte copies of this file (the repo-wide convention).\n#\n# SHAPE: docker-library's docker:29-dind-rootless on Ubuntu 24.04: dockerd, containerd and runc run as the non-root user\n# rootless (uid 1000) inside a rootlesskit user namespace with slirp4netns networking; the container needs --privileged\n# (as docker:dind-rootless does). The Docker API is the unix socket $XDG_RUNTIME_DIR/docker.sock and, with TLS\n# (DOCKER_TLS_CERTDIR=/certs, the default), tcp://0.0.0.0:2376 with client certificates.\n# =====================================================================\nFROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS gobuild\n# libseccomp-dev for runc (built with seccomp support, as upstream builds it), dpkg'd offline.\nRUN --mount=type=bind,source=vendored/builddebs,target=/tmp/builddebs dpkg -i /tmp/builddebs/*.deb\nENV GOTOOLCHAIN=local GOWORK=off GOFLAGS=\"-mod=vendor -buildvcs=false\" GOPROXY=off CGO_ENABLED=0\n# Fail closed on a stale toolchain: `go version <binary>` reads the toolchain recorded in the binary. gocheck ends every\n# compile RUN and empties the Go build cache, so no stage's layer keeps it.\nRUN printf '%s\\n' '#!/bin/sh' 'set -eu' 'for b in \"$@\"; do v=$(go version \"$b\" | awk \"{print \\$2}\"); echo \"$b: $v\";' \\\n      '[ \"$(printf \"%s\\n%s\\n\" go1.26.10 \"$v\" | sort -V | head -n1)\" = go1.26.10 ] || { echo \"$b built with $v < go1.26.10\" >&2; exit 1; }; done' \\\n      'go clean -cache' > /usr/local/bin/gocheck && chmod 0755 /usr/local/bin/gocheck","lines_shown":24,"lines_total":152}},{"path":"Dockerfile.vendor","size":5583,"sha256":"4cbebbd0642a6f6fc1f3b8129087cf2ba121f3d771694f48ff994f9bccbcb4cc","public":"account","lines":78},{"path":"MANIFEST.txt","size":3269822,"sha256":"7a826f6e1ac07e4364fbcea823c4f278565e71c4c77a58cd7bd37dd8341c9c44","public":"account","lines":40513},{"path":"SOURCE_DATE_EPOCH.txt","size":11,"sha256":"c3ed4df2e7e4d39ad2cf4aabccb8f26df7cf35317574182c65debc8a90d9c271","public":"full","lines":1,"url":"/api/recipe/docker/29.9.2-CE-ubuntu24.04-r3/files/SOURCE_DATE_EPOCH.txt","text":"1792515187\n"},{"path":"TARGET_DIGEST.txt","size":358,"sha256":"b530871b8aebb367c86f3915b644745732740050bafd4663be370f36366d06fa","public":"full","lines":8,"url":"/api/recipe/docker/29.9.2-CE-ubuntu24.04-r3/files/TARGET_DIGEST.txt","text":"image_manifest_digest=sha256:f97b1b29d0c0da6df421b790650defe2e2f890540092bc44def0d166398d429b\nconfig_digest=sha256:2f3f6efccec99247420b7bdd4509ef0ae4a9bc9c8142cfefade5e7e97818a743\ntag=readystack/docker:29.9.2-CE-ubuntu24.04-r3\nprobe_port=2376\nprobe_path=/\nprobe_timeout=180\nprobe_exec=docker info --format '{{.ServerVersion}}' >/dev/null\nverify_privileged=1\n"},{"path":"VERIFY_OFFLINE.sh","size":8100,"sha256":"dc0b5cd5c104a5da5c3f4e379e8f3d2eeffa307c8545067925bb4317a722b0b7","public":"account","lines":138},{"path":"dockerd-entrypoint.sh","size":6061,"sha256":"68bef913ac7e3db3bf9be7fce3d67dd28e3de046e9ab220ded532fad2bf04688","public":"account","lines":132},{"path":"docs/PROVENANCE.md","size":1696,"sha256":"da1bcfb0ad079ccc70fe587bc0efedcf2e3b7e83cba306da981c4dd6db0b5045","public":"account","lines":28},{"path":"docs/REBUILD.md","size":5093,"sha256":"66a52ad458bed72f65d6d8e639d18cf27dfb39bbec91003cd3dd765815979d0b","public":"account","lines":57},{"path":"docs/VERIFY.md","size":1954,"sha256":"387a84bca72e6037620b690fe6adab9a885dbf816a8e6a19544d3543f4c35559","public":"account","lines":34},{"path":"docs/provenance/BASE_IMAGE_DIGESTS.lock","size":72,"sha256":"0a9229258091d23e2a111f7ecd9e0834139ecf6987993605fd4b9c35971de884","public":"full","lines":2,"url":"/api/recipe/docker/29.9.2-CE-ubuntu24.04-r3/files/docs/provenance/BASE_IMAGE_DIGESTS.lock","text":"# base images for docker (resolve at build_kit)\ngolang:1.26.10-bookworm\n"},{"path":"docs/provenance/BUILD_RECIPE.json","size":3375,"sha256":"790eb67ba989353bf69cefd13d1124b298362c4270b8bc5bba069ffbba7f1758","public":"account","lines":102},{"path":"docs/provenance/CUSTODY_INPUTS.json","size":648,"sha256":"5cfd6d006dfd6400961b2cf007aa6d3b73535c3479ea9ab8998dab18d08e6249","public":"account","lines":17},{"path":"docs/provenance/SOURCE_FILE_MANIFEST.json","size":348725,"sha256":"67df9dd615e3be0012f568c098f289c8baaefc39488cf528856ea9b38e4f7330","public":"account","lines":5007},{"path":"docs/provenance/SOURCE_TREE_HASH.json","size":307,"sha256":"259376894bdc75bf8df93f4a6d3fbe160ef7bd8180a239974a93394a2bcaf332","public":"full","lines":9,"url":"/api/recipe/docker/29.9.2-CE-ubuntu24.04-r3/files/docs/provenance/SOURCE_TREE_HASH.json","text":"{\n  \"schema\": \"kitforge.source_tree_hash.v1\",\n  \"slug\": \"docker\",\n  \"repo\": \"https://github.com/moby/moby\",\n  \"ref\": \"docker-v29.9.2\",\n  \"commit\": \"0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c\",\n  \"tree_listing_sha256\": \"44eae4a5a04034d7abe6ef9c4e9b882c5401f0fa46613447e99dd431e3de8aaf\",\n  \"file_count\": 13290\n}"},{"path":"docs/provenance/SYSTEM_PINNING.lock","size":99,"sha256":"eb90849a1c7cd0860f77d8bc1c3f915f5bce47c911240d4c23223419594ad87e","public":"account","lines":11},{"path":"docs/provenance/TOOLCHAIN.lock","size":4125,"sha256":"3a96728aa18cba2416431279d6fa57a57b4db884bd66b626f6c2c8e6cb4958d7","public":"account","lines":144},{"path":"go-floors.sh","size":1658,"sha256":"8ac078ef2025ddab1be835c3cac14070887d9d153b9ad14d0d7e93cabdc3722a","public":"account","lines":31},{"path":"rebuild.json","size":1475,"sha256":"4635f8eca956650089a80a7e259a26630a983618401b45707b3e2eca42a9d8c8","public":"account","lines":38},{"path":"toolchain/BUILDKIT_TAG.txt","size":22,"sha256":"fcd530eeb02b063d2f047adad6eef896422a8e8d558513e5f09b2a262be32573","public":"full","lines":1,"url":"/api/recipe/docker/29.9.2-CE-ubuntu24.04-r3/files/toolchain/BUILDKIT_TAG.txt","text":"moby/buildkit:v0.31.2\n"}],"skipped":[],"kit_adds":{"bases":{"files":16,"bytes":326583068},"docs":{"files":13338,"bytes":112745828},"toolchain":{"files":1,"bytes":111529472},"vendored":{"files":27132,"bytes":238865334}},"links":{"page":"https://readystack.dev/products/docker/recipe","signup":"https://readystack.dev/login.html?create=1&next=%2Fproducts%2Fdocker%2Frecipe","kit":"https://readystack.dev/buy.html?product=docker"}}