{"slug":"kubernetesnode","tag":"v1.36.6-CE-scratch-r1","current":true,"account":false,"tarball":"ReadyStack-kubernetesnode-v1.36.6-CE-scratch-r1.tar.gz","tarball_sha256":"a8c27de2f97a7356ebb83b878b33119cd160db933595ebf99e8c054eb2e06092","generated_at":"2026-10-29T19:41:18Z","dockerfile":"Dockerfile.offline.pinned","build_script":"BUILD_OFFLINE.sh","pins":{"upstream":{"repo":"https://github.com/kubernetes/kubernetes","ref":"v1.36.6","commit":"1b2171b110bb2a2542e1322035c6583ec86eb976","url":"https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976"},"components":[{"repo":"https://github.com/containerd/containerd","ref":"v2.3.7","commit":"6f589cf13dc01a5b493911355427e05b2ff005d7","url":"https://github.com/containerd/containerd/tree/6f589cf13dc01a5b493911355427e05b2ff005d7"},{"repo":"https://github.com/opencontainers/runc","ref":"v1.5.2","commit":"29dd3dc2b13b4123162e5fe132504bb4b15569f1","url":"https://github.com/opencontainers/runc/tree/29dd3dc2b13b4123162e5fe132504bb4b15569f1"},{"repo":"https://github.com/seccomp/libseccomp","ref":"v2.6.1","url":"https://github.com/seccomp/libseccomp"},{"repo":"https://github.com/containernetworking/plugins","ref":"v1.9.1","commit":"adc3e6b5b581638afbd194cf2e9319ecbb0151a1","url":"https://github.com/containernetworking/plugins/tree/adc3e6b5b581638afbd194cf2e9319ecbb0151a1"},{"repo":"https://github.com/kubernetes-sigs/cri-tools","ref":"v1.36.0","commit":"88d8ad9d40f82726fda53c2d271e6172b4c619c9","url":"https://github.com/kubernetes-sigs/cri-tools/tree/88d8ad9d40f82726fda53c2d271e6172b4c619c9"},{"repo":"https://github.com/kubernetes/release","ref":"master","commit":"39b0d3dbd9a063e6fc2e26b819de566a1d33b72d","url":"https://github.com/kubernetes/release/tree/39b0d3dbd9a063e6fc2e26b819de566a1d33b72d"}],"fetches":[{"kind":"git","url":"https://github.com/kubernetes/kubernetes.git","ref":"v1.36.6"},{"kind":"git","url":"https://github.com/containerd/containerd.git","ref":"v2.3.7"},{"kind":"git","url":"https://github.com/opencontainers/runc.git","ref":"v1.5.2"},{"kind":"git","url":"https://github.com/containernetworking/plugins.git","ref":"v1.9.1"},{"kind":"git","url":"https://github.com/kubernetes-sigs/cri-tools.git","ref":"v1.36.0"},{"kind":"http","url":"https://github.com/kubernetes/release.git"},{"kind":"http","url":"https://github.com/kubernetes/release"}],"bases":[{"image":"golang:1.26.10-bookworm","digest":"sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af"}],"toolchain":{"buildkit":"moby/buildkit:v0.31.2","buildkit_image_digest":"sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0","builder_images":["golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af"]},"build_method":"source-rebuild-go","source_date_epoch":1793102572,"source_date_epoch_utc":"2026-10-27T12:02:52Z","target":{"image":"readystack/kubernetesnode:v1.36.6-CE-scratch-r1","image_manifest_digest":"sha256:0a264881a0b7357fb20767b0922661bf4ba4423b3e90e595195bf18748a8d79c","config_digest":"sha256:788d2009ba5705e8d590096a0ecefd651ba0ce9d370fd3d36010ac6b203e0e1b"},"checksummed_files":71087},"files":[{"path":"BASES.tsv","size":143,"sha256":"2723d349204e265669d4d19e2e96fc49d3c481b7b964999bae66afcba2519644","public":"full","lines":1,"url":"/api/recipe/kubernetesnode/v1.36.6-CE-scratch-r1/files/BASES.tsv","text":"golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af\tbases/golang_1.26.10-bookworm_632dff735179.oci\n"},{"path":"BUILD_OFFLINE.sh","size":6738,"sha256":"83299978ccd02a0b69e163d760da1211b401bbfa35a3184ca674dc37ff876732","public":"preview","lines":125,"preview":{"text":"#!/usr/bin/env bash\n# =============================================================================\n# ReadyStack — offline reproducible rebuild.\n#\n# Rebuilds this product's image from THIS ARCHIVE ALONE, with no network access\n# of any kind, and prints the resulting linux/amd64 image-manifest digest.\n# Run ./VERIFY_OFFLINE.sh afterwards to assert it equals the published digest.\n#\n# Requirements: linux/amd64 Docker host, docker buildx >= 0.30, jq, tar.\n# No git, no registry access, no additional tooling.\n#\n#   ./BUILD_OFFLINE.sh                the rebuild (OCI image + a docker-loadable copy)\n#   ./BUILD_OFFLINE.sh --provenance   the same rebuild with SLSA v1 build provenance (mode=max) attached to the OCI\n#                                     image, generated by BuildKit, not by any build step. Run on your own hardened,\n#                                     isolated build platform and sign that provenance with a key the build cannot\n#                                     reach, and the result meets SLSA Build Level 3 (see REBUILD.md). The image\n#                                     digest is the same either way.\n# =============================================================================\nset -euo pipefail\nPROVENANCE=0\nfor arg in \"$@\"; do\n  case \"$arg\" in\n    --provenance) PROVENANCE=1 ;;\n    -h|--help) sed -n '2,20p' \"$0\"; exit 0 ;;","lines_shown":24,"lines_total":125}},{"path":"BUILD_TARBALL.sh","size":3095,"sha256":"6d50ea66987d2cc15fb8fa1462fe95b4a42db51cc41778ddf96f5edda460cb17","public":"account","lines":58},{"path":"CHECKSUMS.sha256","size":11425794,"sha256":"9b1d0d7eec7b94efe593f7d7608423b1b617eb9a8b9ea315c750a1c939260857","public":"account","lines":71087},{"path":"DOCKERFILE_NAME.txt","size":26,"sha256":"9aadd1ede68e016a6f163c97befc5ff2fcdc8ebd4f84b108dba63cb195fa8c84","public":"full","lines":1,"url":"/api/recipe/kubernetesnode/v1.36.6-CE-scratch-r1/files/DOCKERFILE_NAME.txt","text":"Dockerfile.offline.pinned\n"},{"path":"Dockerfile","size":17641,"sha256":"2721432873f6be4df4e4f236cb2e1586c062bdb86446d23c4c324d36f06539ca","public":"account","lines":215},{"path":"Dockerfile.offline","size":17641,"sha256":"2721432873f6be4df4e4f236cb2e1586c062bdb86446d23c4c324d36f06539ca","public":"account","lines":215},{"path":"Dockerfile.offline.pinned","size":17641,"sha256":"2721432873f6be4df4e4f236cb2e1586c062bdb86446d23c4c324d36f06539ca","public":"preview","lines":215,"preview":{"text":"# =====================================================================\n# Kubernetes Node v1.36.6 L-009 HERMETIC OFFLINE BUILD: the canonical, attestation-producing build. build_kit runs\n#   docker buildx build --builder readystack-builder-max --network=none\n#     --attest type=provenance,mode=max,version=v1 --attest type=sbom --push <directory context>\n# Pinned-public-base + vendored model: golang 1.26.10 pinned BY DIGEST (BASE_IMAGE_DIGESTS.lock) is the only base;\n# vendored/*-src are fully vendored Go trees (vendored/kubernetesnode-src is kubernetes v1.36.6; GOPROXY=off, vendor/);\n# vendored/libseccomp is the libseccomp release tarball runc links statically (and Debian's gperf .deb its configure needs), vendored/k8s-release-templates the systemd units of the official packages.\n# Dockerfile and Dockerfile.offline are byte copies of this file (the repo-wide convention).\n#\n# SHAPE: a HOST BUNDLE. The image is FROM scratch and holds only the files a kubeadm node's host needs, at the paths\n# they are installed to: /usr/local/bin (kubelet, kubeadm, kubectl, containerd, containerd-shim-runc-v2, ctr, runc,\n# crictl), /opt/cni/bin (the CNI plugins), /etc/systemd/system (kubelet.service + kubeadm's 10-kubeadm.conf drop-in,\n# containerd.service), /etc/containerd (config and registry hosts.toml templates), /etc/crictl.yaml, /etc/default/kubelet,\n# /etc/modules-load.d and /etc/sysctl.d, and /usr/local/share/kubernetesnode (VERSIONS, SHA256SUMS, licences). Every\n# binary is static, so each one runs in this image with no OS underneath. The image runs no service: its default user is\n# 65534:65534 (nobody) and its default command prints kubeadm's version. The same tree is also packed as a\n# deterministic tarball (target `tarball`) that install-node.sh unpacks on an Ubuntu 24.04 host.\n# =====================================================================\n\n# --- kubernetes v1.36.6: kubelet, kubeadm, kubectl ----------------------------------------------------------------------\nFROM golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS kubernetes-build\nWORKDIR /k8s\nCOPY vendored/kubernetesnode-src/ .\nENV CGO_ENABLED=0 GOTOOLCHAIN=local GOFLAGS=-buildvcs=false GOPROXY=off","lines_shown":24,"lines_total":215}},{"path":"Dockerfile.vendor","size":12338,"sha256":"5f29dcdcf01c514b42e3043b47d742c279d4396742eb02b3771bc17377f5117c","public":"account","lines":149},{"path":"MANIFEST.txt","size":6591908,"sha256":"03354c94012810b9c00f42aff4c118624b12f2e5232167530ed791d1c5e0fc29","public":"account","lines":71089},{"path":"SOURCE_DATE_EPOCH.txt","size":11,"sha256":"1baf07802daf74bb53895a5dc126efadea088eaec3460ac65cf3d9b9ca460a3c","public":"full","lines":1,"url":"/api/recipe/kubernetesnode/v1.36.6-CE-scratch-r1/files/SOURCE_DATE_EPOCH.txt","text":"1793102572\n"},{"path":"TARGET_DIGEST.txt","size":507,"sha256":"0ffe4c487533818f82e55423cf1099c1fbbd9aadf6468dae1eda68e04f12dd46","public":"full","lines":13,"url":"/api/recipe/kubernetesnode/v1.36.6-CE-scratch-r1/files/TARGET_DIGEST.txt","text":"image_manifest_digest=sha256:0a264881a0b7357fb20767b0922661bf4ba4423b3e90e595195bf18748a8d79c\nconfig_digest=sha256:788d2009ba5705e8d590096a0ecefd651ba0ce9d370fd3d36010ac6b203e0e1b\ntag=readystack/kubernetesnode:v1.36.6-CE-scratch-r1\nprobe_port=80\nprobe_path=/\nprobe_timeout=180\nprobe_exec=['/usr/local/bin/kubeadm', 'version', '-o', 'short']\nverify_boot=oneshot\nverify_oneshot_arg=/usr/local/bin/kubeadm\nverify_oneshot_arg=version\nverify_oneshot_arg=-o\nverify_oneshot_arg=short\nverify_oneshot_expect=v1.36.6\n"},{"path":"VERIFY_OFFLINE.sh","size":10153,"sha256":"3e8184ea230cfd8f41f977e26be6bf7bd03112c396c517837ce0c7de4f7399dd","public":"account","lines":165},{"path":"containerd-config.toml.tmpl","size":1400,"sha256":"12d03312ddca89c2e16bffab3b5e52bd6a8af3c8d0a9c1763598499cf9ebe881","public":"account","lines":23},{"path":"containerd-registry-auth.toml.tmpl","size":1030,"sha256":"11f4a55f76011bf40834e413f1c9779d1dcd5ae82a58ed3e6425f6b40c781132","public":"account","lines":11},{"path":"crictl.yaml","size":124,"sha256":"ad526395cca4db1e3ea166ddabbba23707829b104215d122f05f8e582cef9050","public":"account","lines":3},{"path":"docs/PROVENANCE.md","size":1712,"sha256":"cf37b8977a443c26e28e68613fc2fe277b00f1ec7b182afbbfa7f719a6fba97e","public":"account","lines":28},{"path":"docs/REBUILD.md","size":5389,"sha256":"001c67fbba871244ef848d724ed28f05be348bacee0ba73375d81633ef77447a","public":"account","lines":59},{"path":"docs/VERIFY.md","size":1983,"sha256":"80ac1cb7e2c81203fcc65ddbd1e7d949e4286956514877c8dae0945b2bff1b09","public":"account","lines":34},{"path":"docs/provenance/BASE_IMAGE_DIGESTS.lock","size":80,"sha256":"2e2bf91059bb901507d237293bb4baa5ef559d0a40309b82481bea973d08423d","public":"full","lines":2,"url":"/api/recipe/kubernetesnode/v1.36.6-CE-scratch-r1/files/docs/provenance/BASE_IMAGE_DIGESTS.lock","text":"# base images for kubernetesnode (resolve at build_kit)\ngolang:1.26.10-bookworm\n"},{"path":"docs/provenance/BUILD_RECIPE.json","size":5364,"sha256":"bc53b3ab64beb3c5fbb1a76509bc610c9fb89e1f7206049d2fed99c5b915d33b","public":"account","lines":95},{"path":"docs/provenance/CUSTODY_INPUTS.json","size":661,"sha256":"92160eaa4a6c3261597e902ac339d571e218ce31ed830173bf16a842ab3e1a6c","public":"account","lines":17},{"path":"docs/provenance/SOURCE_FILE_MANIFEST.json","size":262258,"sha256":"9dbcfdf672e628cef7f89d2a3ab2e3df3a4b4198cbe16a7876853bb775a63bb5","public":"account","lines":5007},{"path":"docs/provenance/SOURCE_TREE_HASH.json","size":320,"sha256":"b9b089678f6c1e6bf02b520d5d2416f8857d497b02434e87175559cca0a2e09b","public":"full","lines":9,"url":"/api/recipe/kubernetesnode/v1.36.6-CE-scratch-r1/files/docs/provenance/SOURCE_TREE_HASH.json","text":"{\n  \"schema\": \"kitforge.source_tree_hash.v1\",\n  \"slug\": \"kubernetesnode\",\n  \"repo\": \"https://github.com/kubernetes/kubernetes\",\n  \"ref\": \"v1.36.6\",\n  \"commit\": \"1b2171b110bb2a2542e1322035c6583ec86eb976\",\n  \"tree_listing_sha256\": \"803692e6a7661d2d72c4cdf0a2a2459bdf6646e2b6c955ed7362f279ee4fa004\",\n  \"file_count\": 29206\n}"},{"path":"docs/provenance/SYSTEM_PINNING.lock","size":1,"sha256":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","public":"account","lines":1},{"path":"docs/provenance/TOOLCHAIN.lock","size":8061,"sha256":"26961b97e123d36547cab950f1d3280515a3e5f654bbfaa81b6982b586d52d03","public":"account","lines":167},{"path":"hosts.toml.tmpl","size":910,"sha256":"5cd8e30cf2029e20d4798c98deb6575c08a291dd6e25900ae66243f7567b9cf7","public":"account","lines":10},{"path":"modules-load.conf","size":140,"sha256":"ee5d366b8d337fc1e9904113f3589da1bfea3ee9952df9c264f3955a2ee16720","public":"account","lines":3},{"path":"rebuild.json","size":1271,"sha256":"230170aa640fc07cf609c6a430bc7495eb9067aa55fe4879edcff73f242bdef2","public":"account","lines":39},{"path":"static-sbom.py","size":6054,"sha256":"37be8271209a99f67c7740085195b62c1e4f5efdc9644362089885b9c78a6705","public":"account","lines":102},{"path":"sysctl.conf","size":227,"sha256":"bac2e6618510187b3dfd316030f5cf1c138096ce6c6b2f3bd848acfa2ee8a7e3","public":"account","lines":4},{"path":"toolchain/BUILDKIT_TAG.txt","size":22,"sha256":"fcd530eeb02b063d2f047adad6eef896422a8e8d558513e5f09b2a262be32573","public":"full","lines":1,"url":"/api/recipe/kubernetesnode/v1.36.6-CE-scratch-r1/files/toolchain/BUILDKIT_TAG.txt","text":"moby/buildkit:v0.31.2\n"}],"skipped":[],"kit_adds":{"bases":{"files":11,"bytes":296811899},"docs":{"files":29262,"bytes":249340997},"toolchain":{"files":1,"bytes":111529472},"vendored":{"files":41783,"bytes":377836849}},"links":{"page":"https://readystack.dev/products/kubernetesnode/recipe","signup":"https://readystack.dev/login.html?create=1&next=%2Fproducts%2Fkubernetesnode%2Frecipe","kit":"https://readystack.dev/buy.html?product=kubernetesnode"}}