Products
Each listing is one Community Edition release. The image is free, and so is its Hermetic Build Kit: ReadyStack does not charge for recipes or build kits, we only ask you to sign up. Register once, and every kit's button says Download.
SLSA-enabling: build it on your own infrastructure. The Hermetic Build Kit for that exact release: its pinned base images, source, packages and toolchain, not a copy of the published image. Rebuild, verify and operate it offline. Free to download for any registered account.
- Rebuilds the Docker Hub image with the network off; each listing says whether that rebuild has been verified bit-for-bit, and when
- SLSA provenance:
--provenanceon your own platform, signed with your key (kits from 2026-10-10) - Handbooks checked against the exact image: admin, database, API
- Seed data and use-case tests run against the image
- Security report, defects, provenance: SBOM, recipe, checksums, signatures
- See real excerpts · How a release is built
The release image, signed by ReadyStack, with its SBOM and build provenance attached. Pull and run it; no account needed.
docker pull readystack/<product>:<release tag>
# check it is ours before you run it cosign verify --key https://readystack.dev/keys/cosign.pub \ readystack/<product>:<release tag>
- Scans
- Every published image, every day, the same way: a syft SBOM, grype vulnerability matches, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26: out of 100, A from 85, F below 40. Vulnerabilities deduct (more when a fix exists); a non-root user, signatures, provenance and an SBOM add. ce.rodeo now scores with cerodeo-v2, which also deducts for unfixable medium findings and caps the grade of an image with many findings, so ce.rodeo grades most of these releases lower than we do. “How it was scored” lists every line and the scanner versions.
- Original and current grade
- The original grade is our first recorded scan of the release, shown with the day the release was pushed to Docker Hub (we began recording scans on 2026-10-10, so releases pushed before then show that day's scan). The current grade is the most recent daily scan of the same image. New vulnerabilities are published daily, so the current grade is often lower; a new release replaces the listing.
- Docker Hub pulls
- Pulls of the product's repository, all tags (Docker Hub does not count pulls per tag).
- Same image as Docker Hub
- Whether, and when, we rebuilt the release from its build kit with the network off and got the free image's linux/amd64 digest.
- Defects
- Problems recorded against the image, build kit or documentation: most found in our review rounds and fixed before release; open ones are in the release's defects report. See the defect log.
The data on this page, as JSON: /api/products and /api/scans (described here).
| Release | Docker Hub pulls | Original grade | Current grade | Same image as Docker Hub | Defects | Get it |
|---|---|---|---|---|---|---|
Apache Airflowreadystack/airflow:3.3.2-CE-ubuntu24.04-r5Who uses it, and whyWho: Data engineers and platform teams who run scheduled data pipelines, batch jobs and model training. Why: Airflow lets them write workflows as Python code, then schedules each task in dependency order and shows runs, progress and failures in a web interface. Use case: Every night a team pulls sales data from several systems, cleans it and loads it into a reporting database. In Airflow each step is a task in one workflow file kept in version control; the scheduler runs the steps in order, and when one fails the team sees which step broke and why. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
B · 76 scanned 2026-11-06C 1 · H 0 · M 118How it was scored
100 −24 = 76. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Apache Kafkareadystack/kafka:4.4.0-CE-ubuntu24.04-r2Who uses it, and whyWho: Engineering teams who move streams of events between systems in real time, for data pipelines, analytics and event-driven applications. Why: Kafka is a distributed event streaming platform. Applications publish streams of events, Kafka stores them durably, and other applications read and process them in real time or later. Use case: An online retailer records every order, payment and shipment as an event. Kafka stores those streams, and the warehouse system, the fraud checks and the analytics database each read them at their own pace, instead of every system calling every other system directly. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 2 · M 83How it was scored
100 +5 = 105, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Apache Supersetreadystack/superset:6.1.0-CE-ubuntu24.04-r3Who uses it, and whyWho: Data teams and business users who explore data and build dashboards on top of their SQL databases. Why: Apache Superset is an open-source data exploration and visualisation platform: a no-code chart builder, a web-based SQL editor, a light semantic layer, and support for nearly any SQL database. Use case: A data team's warehouse holds sales and marketing data that managers want to see daily. Analysts define the shared metrics once in Superset, managers build their own charts with the no-code interface, and analysts dig deeper with the SQL editor when a number looks wrong. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
F · 36 scanned 2026-11-06C 1 · H 4 · M 107How it was scored
100 −64 = 36. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Argo CDreadystack/argocd:v3.5.6-CE-ubuntu24.04-r1Who uses it, and whyWho: Platform and DevOps teams who deploy applications to Kubernetes clusters. Why: Argo CD treats a Git repository as the source of truth for what should run. It compares each cluster with Git, shows the differences, and syncs the cluster back to the declared state. Use case: A team keeps the manifests for its services in Git. A change merged there is what reaches staging and production: Argo CD notices the new target state and applies it, and if someone edits a cluster by hand, the application shows as out of sync until it is brought back in line. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +22 = 122, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
D · 49 scanned 2026-11-06C 0 · H 7 · M 279How it was scored
100 −51 = 49. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
authentikreadystack/authentik:2026.8.5-CE-ubuntu24.04-r4Who uses it, and whyWho: System administrators and security engineers who run single sign-on for self-hosted applications. Why: authentik is an identity provider: people sign in once and reach every connected application over SAML, OAuth, OpenID Connect, LDAP or RADIUS, and administrators manage users and passwords in one place. Use case: A small company runs a wiki, a Git server and a monitoring dashboard, each with its own logins. With authentik in front of them, staff sign in once, administrators manage accounts in one place, and deactivating a departing employee's account in authentik stops them signing in to any connected app. |
Not available | A · 100 pushed and scanned 2026-11-01How it was scored
100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-31T06:18:17Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 156How it was scored
100 +3 = 103, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
BookStackreadystack/bookstack:v26.09.2-CE-ubuntu24.04-r3Who uses it, and whyWho: Teams and organisations that want a simple, self-hosted place to write and organise documentation. Why: BookStack stores knowledge as books, chapters and pages, with a simple WYSIWYG editor and full search, so anyone with basic word-processing skills can write and find documentation. Use case: An IT team keeps runbooks, onboarding notes and how-to guides in scattered files. In BookStack each system gets a book, each topic a chapter and each procedure a page; new staff search one place, and anyone who can use a word processor can keep a page up to date. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 153How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Caddyreadystack/caddy:v2.11.7-CE-ubuntu24.04-r5Who uses it, and whyWho: Developers and system administrators who serve websites, APIs and apps and want HTTPS without handling certificates by hand. Why: Caddy is a web server and reverse proxy with HTTPS on by default: it gets and renews certificates for public names and runs its own local certificate authority for internal names. Use case: A small team runs several web apps on one server. A short Caddyfile puts each app behind its own domain name as a reverse proxy; Caddy obtains and renews the certificates and redirects plain HTTP to HTTPS, so nobody copies certificate files around or tracks expiry dates. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 2 · M 83How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Canvas LMSreadystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2Who uses it, and whyWho: Colleges, universities and schools that run their own learning management system. Why: Canvas LMS gives each course an online home where instructors publish content and assignments, post announcements, hold discussions and record grades in a gradebook. Use case: A college moves its courses online. Each course gets a Canvas site where the instructor publishes materials and assignments with due dates, students take part in course discussions, and marks go into a gradebook that shows each learner's progress. |
Not available | A · 100 pushed and scanned 2026-10-30How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 1 · H 0 · M 96How it was scored
100 +3 = 103, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
changedetection.ioreadystack/changedetection:0.60.10-CE-ubuntu24.04-r1Who uses it, and whyWho: People and teams who watch web pages for changes to prices, stock levels, job listings or policies. Why: changedetection.io checks web pages on a schedule you set, can watch only the part of a page you choose, and sends a notification when that content changes. Use case: A small shop tracks the prices its suppliers publish. changedetection.io checks each supplier page during business hours, watches only the price element picked with a CSS selector, and sends an email or webhook when it changes, so nobody has to reload the pages by hand. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
B · 82 scanned 2026-11-06C 1 · H 0 · M 129How it was scored
100 −18 = 82. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
cloudflaredreadystack/cloudflared:2026.10.5-CE-ubuntu24.04-r1Who uses it, and whyWho: Teams who want to publish or reach internal services through Cloudflare Tunnel without opening inbound firewall ports. Why: cloudflared is the client for Cloudflare Tunnel. It makes outbound-only connections from your network, and requests for your services come back through them, so your servers need no public IP address. Use case: A team runs an internal dashboard on a server with no public address. cloudflared on that network opens a Cloudflare Tunnel; users reach the dashboard through the tunnel, and the firewall keeps every inbound port closed. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 80How it was scored
100 +15 = 115, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Coderreadystack/coder:v2.38.3-CE-ubuntu24.04-r2Who uses it, and whyWho: Platform teams who give developers standard, ready-to-use development environments on infrastructure they control. Why: Coder creates development workspaces from templates that administrators maintain. Developers connect from their own editor, and workspaces left idle shut down automatically. Use case: New developers on a large codebase spend days setting up laptops. With Coder, the platform team writes one workspace template; a new developer creates a workspace from it and starts work right away, and workspaces left idle overnight shut down on their own. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 95How it was scored
100 +12 = 112, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Consulreadystack/consul:v1.16.4-CE-ubuntu24.04-r5Who uses it, and whyWho: Operations and platform teams who run many services across servers, data centres or clusters that need to find each other. Why: Consul keeps a registry of services. Services register themselves and find each other over DNS or HTTP, health checks keep traffic away from failing instances, and an HTTP API stores shared configuration. Use case: A team runs internal services on virtual machines whose addresses change as machines are replaced. Each service registers with Consul and looks up the others by name over DNS; when an instance fails its health check, it drops out of the answers until it recovers. |
Not available | A · 100 pushed and scanned 2026-11-03How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-03T06:20:47Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 12How it was scored
100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-03 | Defect log | Docker Hub Register Source and recipe |
CoreDNSreadystack/coredns:v1.14.2-CE-ubuntu24.04-r1Who uses it, and whyWho: Platform engineers and network administrators who run DNS for Kubernetes clusters or internal networks. Why: CoreDNS is a DNS server built from plugins. It can serve zone files, forward and cache queries, and answer for Kubernetes services, each feature switched on in its configuration file. Use case: In a Kubernetes cluster, CoreDNS answers pods' lookups for the cluster's service names and forwards other names to upstream resolvers. On an office network, the same server can serve internal names from a zone file and cache lookups for everything else. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 11How it was scored
100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
CrowdSecreadystack/crowdsec:v1.8.1-CE-ubuntu24.04-r4Who uses it, and whyWho: System administrators, DevOps and SRE teams who need to spot and block attacks on internet-facing servers. Why: CrowdSec's Security Engine reads logs and HTTP requests, detects behaviour such as brute force and scans, and has a firewall or reverse proxy block the offending IP addresses. Use case: A web server's logs show constant password guessing against its login page. CrowdSec parses those logs, recognises the brute-force pattern, and a remediation component on the firewall blocks the source address, without anyone writing ban rules by hand. Attacks it reports feed a shared community blocklist. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 96 scanned 2026-11-06C 0 · H 4 · M 81How it was scored
100 −4 = 96. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Discoursereadystack/discourse:v2026.9.1-CE-ubuntu24.04-r1Who uses it, and whyWho: Organisations, open-source projects and online communities that want a discussion forum under their own control. Why: Discourse is a community discussion platform. Members start topics and reply in threads, talk in built-in chat, and the site can be customised with themes and plugins. Use case: A software project moves user questions out of private email into a public Discourse forum. Questions and answers stay visible as topics, so the next person with the same problem finds the earlier answer, and maintainers use chat for quick conversations. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +32 = 132, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
B · 70 scanned 2026-11-06C 2 · H 2 · M 1366How it was scored
100 −30 = 70. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Distribution Registryreadystack/registry:v3.1.2-CE-ubuntu24.04-r5Who uses it, and whyWho: Teams who want to store and distribute their container images on infrastructure they control. Why: Distribution Registry is the open-source server that stores container images and other content and serves them using the OCI Distribution Specification. Use case: A company's build system produces container images that must stay inside its network. It runs Distribution Registry internally: the build pipeline pushes each image there, and every server pulls from it, so image storage and distribution are fully under the company's control. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 80How it was scored
100 +15 = 115, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Dockerreadystack/docker:29.9.2-CE-ubuntu24.04-r3Who uses it, and whyWho: Developers and operations teams who build, ship and run applications in containers. Why: Docker Engine is the daemon, API and command-line client that build container images and create and manage containers, networks and volumes. Use case: A team needs a container engine on a shared build host but does not want the daemon running as root. Docker's rootless mode runs the daemon and its containers inside a user namespace as an ordinary user, which limits the damage a vulnerability in the daemon or the container runtime can do. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
F · 21 scanned 2026-11-06C 0 · H 8 · M 83How it was scored
100 −79 = 21. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
DocuSealreadystack/docuseal:3.3.3-CE-alpine-r3Who uses it, and whyWho: Businesses and teams, such as HR and sales, who send documents for signature and keep them on their own server. Why: DocuSeal turns a PDF into a form with signature, date and other fields, sends it to one or more signers by email, and signs the completed PDF electronically so the signature can be verified. Use case: An HR team sends each new hire a contract to sign. They place signature, date and checkbox fields on the PDF once in the form builder, then send it; each hire fills it in and signs on a phone or laptop, and the signed PDFs are stored on the company's own server. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
B · 73 scanned 2026-11-06C 2 · H 4 · M 5How it was scored
100 −27 = 73. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Drupalreadystack/drupal:11.4.11-CE-ubuntu24.04-r2Who uses it, and whyWho: Government agencies, universities, media companies and other organisations that build content-rich websites. Why: Drupal is content management software for websites and applications built on structured content. Its core does a lot on its own and can be extended with free, open-source modules. Use case: A university needs department pages, event listings and staff profiles in one site. In Drupal editors fill in structured content, themes control how it is presented, and modules add features before anyone writes custom code. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 165How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
ERPNextreadystack/erpnext:v16.53.0-CE-ubuntu24.04-r1Who uses it, and whyWho: Businesses that want accounting, inventory, sales, manufacturing and projects in one system. Why: ERPNext is an open-source ERP: invoices, stock, sales orders, suppliers, production, assets and project timesheets in one application instead of separate tools. Use case: A small manufacturer tracks orders in spreadsheets, stock in another tool and invoices in a third. In ERPNext sales orders, stock levels, material consumption and invoices live in one system, so the books, the warehouse and the production floor work from the same records. |
Not available | A · 100 pushed and scanned 2026-11-01How it was scored
100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 797How it was scored
100 +16 = 116, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
etcdreadystack/etcd:v3.7.3-CE-ubuntu24.04-r1Who uses it, and whyWho: Platform engineers who run Kubernetes control planes, and developers of distributed systems that need consistent shared state. Why: etcd is a distributed, reliable key-value store for a distributed system's most critical data. It replicates writes across its members with the Raft consensus algorithm, so the data stays consistent when a member fails. Use case: A Kubernetes control plane keeps all of its API data in etcd. Running etcd as a cluster of members on separate machines means the cluster's state survives the loss of one machine, and the remaining members keep serving reads and writes. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 89 scanned 2026-11-06C 0 · H 3 · M 82How it was scored
100 −11 = 89. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
flannelreadystack/flannel:v0.28.10-CE-ubuntu24.04-r1Who uses it, and whyWho: Kubernetes cluster operators who need a simple network that connects pods across nodes. Why: flannel makes every pod's address reachable across the cluster. An agent on each host leases that host a subnet from a shared range and carries traffic between hosts, for example over VXLAN. Use case: A team building an on-premises Kubernetes cluster needs pods on different nodes to reach each other without port mapping. flannel runs on every node, gives each node a subnet of the pod address range, and forwards pod traffic between nodes over VXLAN. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 2 · M 71How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
flannel CNI pluginreadystack/flannelcniplugin:v1.9.1-flannel3-CE-ubuntu24.04-r1Who uses it, and whyWho: Kubernetes cluster operators who use flannel for pod networking. Why: The flannel CNI plugin connects each new pod to the flannel network: it reads the subnet flannel leased to the host and configures a standard CNI plugin, such as bridge, with it. Use case: When the container runtime starts a pod on a node running flannel, it calls the flannel CNI plugin. The plugin reads the node's flannel subnet settings and delegates to the bridge plugin, which gives the pod an address from that subnet, so new pods join the cluster network with no manual setup. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 18How it was scored
100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Fluent Bitreadystack/fluentbit:v5.1.5-CE-ubuntu24.04-r1Who uses it, and whyWho: Operations and platform teams who collect logs, metrics and traces from servers, containers and devices. Why: Fluent Bit is a lightweight telemetry agent. It collects logs, metrics and traces from many sources, filters and processes them, and forwards them to the destinations you choose. Use case: A team runs applications on many servers and containers and wants all their logs in one central store. Fluent Bit on each host reads the log files, parses and filters the records, and forwards them to the team's log backend, while using little CPU and memory on the hosts. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 71How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Frappe CRMreadystack/frappecrm:v1.90.0-CE-ubuntu24.04-r2Who uses it, and whyWho: Sales teams that want a simple, customisable CRM they can host themselves. Why: Frappe CRM tracks leads and deals. Each one has a single page with its activities, comments, notes and tasks, and a Kanban board shows every deal's stage. Use case: A small sales team tracks prospects in spreadsheets and email threads. In Frappe CRM each lead has one page with its notes, tasks and activity, and the team drags its leads and deals across its own stages on a Kanban board, so anyone can see where every deal stands. |
Not available | A · 100 pushed and scanned 2026-11-01How it was scored
100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 797How it was scored
100 +16 = 116, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Ghostreadystack/ghost:v6.72.0-CE-ubuntu24.04-r5Who uses it, and whyWho: Writers, independent publishers and media teams who run a publication with a newsletter and paid memberships. Why: Ghost is an open-source publishing platform for running a website, email newsletters, memberships and paid subscriptions from one place. Use case: A journalist leaves a newspaper to publish independently. On Ghost each article appears on the website and goes out as a newsletter, readers sign up as free or paying members, and the publication and its audience stay on a site the writer controls. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +10 = 110, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
C · 67 scanned 2026-11-06C 0 · H 3 · M 94How it was scored
100 −33 = 67. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Giteareadystack/gitea:v28.2.0-CE-ubuntu24.04-r2Who uses it, and whyWho: Development teams who want a self-hosted Git service with code review, issues and CI/CD in one place. Why: Gitea is a self-hosted, all-in-one software development service: Git hosting, code review, issue tracking, project boards, a wiki, a package registry and CI/CD in one application. Use case: A company must keep its source code on its own servers. Gitea gives its developers repositories, pull requests with code review, issues and a wiki on one internal server, and its built-in CI/CD builds and tests each change there too. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 96 scanned 2026-11-06C 0 · H 2 · M 127How it was scored
100 −4 = 96. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Grafanareadystack/grafana:v13.3.0-CE-ubuntu24.04-r1Who uses it, and whyWho: Operations, SRE and development teams who need dashboards and alerts over their metrics, logs and traces. Why: Grafana queries, visualises and alerts on metrics, logs and traces wherever they are stored, and lets teams build and share dashboards that mix several data sources. Use case: An operations team keeps server metrics in one database and application logs in another. A Grafana dashboard shows both for each service, an alert rule notifies the on-call engineer when errors climb, and the engineer moves from the graph to the matching logs with the same filters. |
Not available | A · 100 pushed and scanned 2026-10-30How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 80How it was scored
100 +15 = 115, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
HAProxyreadystack/haproxy:3.4.6-CE-ubuntu24.04-r4Who uses it, and whyWho: Operations teams and site reliability engineers who run busy websites and services that need load balancing and high availability. Why: HAProxy is a reverse proxy and load balancer for TCP and HTTP applications. It spreads traffic across servers, checks their health, terminates TLS, and can rate-limit or block abusive clients. Use case: An online shop runs its web application on several servers. HAProxy in front terminates HTTPS, sends each request to a server that passes its health checks, keeps a shopper's session on the same server, and slows down or blocks clients that send abusive request rates. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 86How it was scored
100 +4 = 104, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Harborreadystack/harbor:v2.15.4-CE-ubuntu24.04-r4Who uses it, and whyWho: Platform and DevOps teams who run their own container registry for Kubernetes and other container platforms. Why: Harbor is an open-source registry that stores container images, scans them for vulnerabilities, signs them, controls access by role, and replicates images between registries. Use case: A company wants every image its clusters run to come from a registry it controls. Teams push images to their projects in Harbor, each image is scanned for vulnerabilities, a policy check keeps vulnerable images from being deployed, and replication copies images to a second registry near another data centre. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +19 = 119, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
D · 46 scanned 2026-11-06C 0 · H 10 · M 249How it was scored
100 −54 = 46. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Home Assistantreadystack/homeassistant:2026.10.4-CE-ubuntu24.04-r1Who uses it, and whyWho: Home owners, tinkerers and DIY enthusiasts who want to automate their homes with local control and privacy. Why: Home Assistant is open-source home automation. It brings devices from many makers together through integrations and runs automations locally, on a small computer or server at home. Use case: A household has smart plugs, motion sensors and a thermostat from different makers, each with its own app. Home Assistant brings them into one dashboard and runs automations such as switching off the lights when everyone has left, on a local server, so the home's data stays in the house. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 88 scanned 2026-11-06C 1 · H 0 · M 1170How it was scored
100 −12 = 88. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
InfluxDBreadystack/influxdb:v3.12.1-CE-ubuntu24.04-r2Who uses it, and whyWho: Engineers who collect time-stamped data such as sensor readings, server metrics and network measurements. Why: InfluxDB is a database built to collect, process and store event and time series data, and to answer queries on recent data quickly for dashboards, monitoring and automation. Use case: A factory streams readings from its machine sensors every few seconds. InfluxDB ingests them as they arrive, a dashboard queries the latest values with SQL, and a Python plugin running inside the database reacts when a reading crosses a threshold. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 182How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Jenkinsreadystack/jenkins:2.580.1-CE-ubuntu24.04-r4Who uses it, and whyWho: Development and DevOps teams who automate building, testing and deploying their software. Why: Jenkins is an open-source automation server. With its plugins it runs the repetitive parts of the development workflow: builds, tests, static code analysis and deployments. Use case: Each time a developer pushes code, Jenkins checks it out, builds it and runs the test suite, so a bug is caught as soon as it is introduced. When the tests pass on the main branch, the same pipeline deploys the build to a test environment. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 124How it was scored
100 +16 = 116, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Jitsi Meetreadystack/jitsi:stable-11248-CE-ubuntu24.04-r2Who uses it, and whyWho: Organisations and individuals who want to run their own video meetings. Why: Jitsi Meet is open-source video conferencing that works in the browser and in mobile apps, with screen sharing, chat, polls and raise-hand, and it can be embedded in other web applications. Use case: A school wants video lessons without sending its classes through an outside service. It runs Jitsi Meet on its own server; teachers share a meeting link, students join from a browser or the mobile app, and the teacher shares slides and runs quick polls during the lesson. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 79How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Keycloakreadystack/keycloak:26.8.2-CE-ubuntu24.04-r1Who uses it, and whyWho: Developers and identity teams who need login, single sign-on and user management for their applications. Why: Keycloak is open-source identity and access management. Users sign in to Keycloak instead of each application, which gives single sign-on and sign-out, social login, LDAP user federation and fine-grained authorization. Use case: A company builds several internal web apps and does not want each one to store passwords. Each app hands login to Keycloak over OpenID Connect; employees sign in once with their existing directory accounts, and logging out of one app logs them out of all of them. |
Not available | A · 100 pushed and scanned 2026-11-06How it was scored
100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 112How it was scored
100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-06 | Defect log | Docker Hub Register Source and recipe |
kube-apiserverreadystack/kubeapiserver:v1.36.6-CE-ubuntu24.04-r1Who uses it, and whyWho: Cluster administrators and platform engineers who build and run their own Kubernetes control plane. Why: kube-apiserver serves the Kubernetes API. It validates and configures the cluster's objects, such as pods and services, and is the front end to the shared state that every other component works through. Use case: When an engineer applies a new deployment, the request goes to kube-apiserver. It checks the request, runs admission control and stores the result in etcd; the scheduler, the controllers and the kubelet on each node watch the API server and act on the change. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 69How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
kube-controller-managerreadystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r1Who uses it, and whyWho: Cluster administrators and platform engineers who build and run their own Kubernetes control plane. Why: kube-controller-manager runs the control loops built into Kubernetes. Each controller watches the cluster's state through the API server and makes changes that move the current state towards the desired state. Use case: A team asks for several replicas of a web server. When a node fails and its pods disappear, a controller in kube-controller-manager sees fewer replicas than requested and creates replacements; other controllers keep namespaces, endpoints and service accounts in line, without an operator stepping in. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 69How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
kube-proxyreadystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r1Who uses it, and whyWho: Cluster administrators who run Kubernetes nodes. Why: kube-proxy runs on each node and maintains the network rules that make Kubernetes Services work, forwarding traffic sent to a Service to one of the pods behind it. Use case: A web front end calls a database through a Kubernetes Service. kube-proxy on every node keeps rules that send traffic for that Service to one of the database pods, wherever they run, and updates the rules as pods are replaced. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 69How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
kube-schedulerreadystack/kubescheduler:v1.36.6-CE-ubuntu24.04-r1Who uses it, and whyWho: Cluster administrators and platform engineers who build and run their own Kubernetes control plane. Why: kube-scheduler decides where each new pod runs. It filters out nodes that cannot run the pod, scores the rest against resources and constraints such as affinity, and binds the pod to the highest-scoring node. Use case: A team deploys a memory-hungry service whose replicas must not share a node. kube-scheduler skips nodes without enough free memory, honours the anti-affinity rule and places each replica on a different suitable node; if no node fits, the pod waits until one does. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 69How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
kube-vipreadystack/kubevip:v1.3.1-CE-ubuntu24.04-r1Who uses it, and whyWho: Administrators of on-premises, edge and bare-metal Kubernetes clusters who need a highly available control-plane address. Why: kube-vip gives a Kubernetes cluster a virtual IP address and load balancer for its control plane and for LoadBalancer Services, announced over ARP or BGP, without external load-balancing hardware or software. Use case: A team runs Kubernetes on its own servers with several control-plane nodes. kube-vip holds one virtual address for the API server on the elected leader and moves it to another control-plane node when the leader fails, so the worker nodes and administrators keep using the same address. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 10How it was scored
100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Kubernetesreadystack/kubernetes:v1.37.1-CE-ubuntu24.04-r2Who uses it, and whyWho: Platform and operations teams who run containerised applications across many machines. Why: Kubernetes is an open-source system for deploying, scaling and managing containerised applications across hosts, with service discovery, load balancing, automated rollouts and rollbacks, and self-healing. Use case: A team runs an online shop as several services in containers. In Kubernetes they declare how many copies of each should run; Kubernetes places them on machines, restarts containers that fail, balances traffic between copies, and rolls out a new version step by step, and can roll it back to the previous version. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
F · 0 scanned 2026-11-06C 0 · H 17 · M 243How it was scored
100 −190 = −90, held to 0 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Kubernetes Nodereadystack/kubernetesnode:v1.36.6-CE-scratch-r1Who uses it, and whyWho: Cluster administrators who add their own Linux servers to a Kubernetes cluster, for example with kubeadm. Why: A Kubernetes node runs the kubelet, a container runtime and network plugins. The kubelet registers the machine with the control plane and makes sure the pods assigned to it are running. Use case: A team adds new servers to an on-premises cluster. Each server gets the kubelet, a container runtime and the network plugins; kubeadm join registers it with the control plane, and from then on the scheduler can place pods there and the kubelet keeps them running. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
F · 0 scanned 2026-11-06C 1 · H 18 · M 24How it was scored
100 −111 = −11, held to 0 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Kubernetes VM Stackreadystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2Who uses it, and whyWho: Teams that run a fleet of virtual machines on their own hardware and want them managed beside their containers. Why: Kubernetes with KubeVirt adds virtual machines to the Kubernetes API: one API and one set of manifests for virtual machines and containers, on the same cluster and nodes. Use case: A team has applications that still need full virtual machines and new services built as containers. On one Kubernetes cluster with KubeVirt they create, start, stop and migrate the virtual machines through the same Kubernetes API as their pods, and can move the VM workloads into containers over time. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 0How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Lokireadystack/loki:v3.7.9-CE-ubuntu24.04-r3Who uses it, and whyWho: Operations and platform teams who collect logs from many services, especially on Kubernetes, and read them alongside metrics in Grafana. Why: Loki is a log aggregation system that indexes only a set of labels for each log stream instead of the full text, which keeps it simpler to operate and cheaper to run. Use case: A team runs many services on Kubernetes and needs their logs in one place. An agent ships each pod's logs to Loki with the pod's labels; when an alert fires, an engineer filters by those labels in Grafana and reads the matching logs next to the metrics. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 79How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
MariaDBreadystack/mariadb:12.3.3-CE-ubuntu24.04-r4Who uses it, and whyWho: Developers and database administrators who need a relational SQL database for websites and business applications. Why: MariaDB Server is an open-source relational database with an SQL interface, pluggable storage engines, replication and clustering, and JSON, GIS and vector search features. Use case: A web application keeps its customers, orders and content in MariaDB. A replica on a second server receives every change, so reports can run there without slowing the main database, and a current copy of the data is ready if the primary server fails. |
Not available | A · 100 pushed and scanned 2026-11-05How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-04T06:20:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 60How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-05 | Defect log | Docker Hub Register Source and recipe |
| Mastodonreadystack/mastodon:v4.7.4-CE-ubuntu24.04-r1 | Not available | A · 100 pushed and scanned 2026-11-01How it was scored
100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 107How it was scored
100 +16 = 116, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Mattermostreadystack/mattermost:v12.0.1-CE-ubuntu24.04-r1Who uses it, and whyWho: Technical teams, such as software, security and IT operations groups, that want team chat on infrastructure they control. Why: Mattermost is a self-hosted collaboration platform with public and private channels, direct messages and threads on web, desktop and mobile, extended through webhooks, slash commands, bots and plugins. Use case: A company's engineering and operations teams need chat that stays on their own servers. In Mattermost each service has a channel, monitoring alerts arrive through incoming webhooks, and during an incident the responders coordinate in one channel from a laptop or a phone. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 2 · M 133How it was scored
100 +2 = 102, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Metabasereadystack/metabase:v0.64.3.5-CE-ubuntu24.04-r1Who uses it, and whyWho: Companies that want everyone, not only analysts, to ask questions of their data. Why: Metabase is an open-source business intelligence tool. People explore data and build charts and dashboards without knowing SQL, and analysts use its SQL editor for more complex queries. Use case: A start-up's product data sits in its application database and only engineers can query it. With Metabase connected to that database, the support lead charts tickets per customer without writing SQL, and the finance team gets a dashboard with filters it checks each week. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 94How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Mimirreadystack/mimir:3.2.3-CE-ubuntu24.04-r3Who uses it, and whyWho: Platform and SRE teams who need to keep and query metrics from many clusters and teams over long periods. Why: Grafana Mimir is horizontally scalable, highly available, multi-tenant long-term storage for Prometheus and OpenTelemetry metrics, with queries that aggregate series from many sources into a global view. Use case: A company runs a Prometheus server in each of its clusters, each keeping only recent data. They all send metrics to Mimir, which keeps them durably in object storage, and engineers query months of history across every cluster at once from one place. |
Not available | A · 100 pushed and scanned 2026-11-02How it was scored
100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 90 scanned 2026-11-06C 0 · H 2 · M 85How it was scored
100 −10 = 90. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Minifluxreadystack/miniflux:2.3.4-CE-ubuntu24.04-r3Who uses it, and whyWho: Individuals and small teams who follow news, blogs and podcasts through feeds and want a simple self-hosted reader. Why: Miniflux is a minimalist, self-hosted feed reader designed for readability. It can fetch the full original article and removes pixel trackers and tracking parameters. Use case: A developer follows many blogs, release notes and news sites. Miniflux checks every feed, shows unread articles in a clean layout that works from the keyboard, fetches the full text when a feed carries only a summary, and strips trackers along the way. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 10How it was scored
100 +36 = 136, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
MinIOreadystack/minio:RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7Who uses it, and whyWho: Teams who need object storage on their own hardware for backups, analytics data and application files. Why: MinIO is open-source object storage compatible with an established cloud object-storage API, so existing tools and applications written for that API can store data on your own servers. Use case: A team's backup software and data pipelines are written for cloud object storage, but the data must stay on site. They point those tools at MinIO on their own servers and keep their backups and datasets in buckets there. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 83How it was scored
100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Moodlereadystack/moodle:v5.3.0-CE-ubuntu24.04-r4Who uses it, and whyWho: Schools, universities, companies and other organisations that run online learning and training. Why: Moodle is an open-source learning management system that gives educators, administrators and learners one integrated system for courses, activities, assignments, grading and progress tracking. Use case: A company trains staff in several offices. In Moodle the training team builds self-paced courses with forums and assignments, enrols each group of staff in the courses for their role, and tracks who has completed which course. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 154How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Multus CNIreadystack/multuscni:v4.3.1-CE-ubuntu24.04-r1Who uses it, and whyWho: Kubernetes operators whose pods need more than one network interface, for example to reach a separate storage or management network. Why: Multus CNI lets a pod have several network interfaces. It acts as a meta-plugin, calling other CNI plugins to attach extra networks alongside the cluster's default pod network. Use case: A team runs workloads that must also sit on a separate VLAN. With Multus, each pod keeps its normal interface on the cluster network and gets an additional interface on the VLAN, described in a network attachment definition and created by another CNI plugin. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
C · 55 scanned 2026-11-06C 0 · H 7 · M 16How it was scored
100 −45 = 55. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
MySQLreadystack/mysql:9.7.4-CE-ubuntu24.04-r3Who uses it, and whyWho: Developers and database administrators who need a relational SQL database for web and business applications. Why: MySQL is a relational database server. Data lives in tables that applications add to, query and change with SQL, through a wide range of client libraries and APIs. Use case: An online store keeps its products, customers and orders in MySQL tables. The web application reads and writes them with SQL through a client library for its language, and administrators manage the server, its users and its databases with MySQL's own tools. |
Not available | A · 100 pushed and scanned 2026-11-05How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 60How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-05 | Defect log | Docker Hub Register Source and recipe |
NATSreadystack/nats:v2.15.2-CE-ubuntu24.04-r2Who uses it, and whyWho: Developers and platform teams who connect services, edge devices and IoT systems through messaging. Why: NATS is a simple, secure, open-source messaging system. Applications connect to a NATS server and exchange messages by subject, without knowing each other's network addresses. Use case: A team splits an application into small services. Instead of each service keeping a list of the others' addresses, services publish and subscribe on named NATS subjects; a new service joins by subscribing, and nothing else has to be reconfigured. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 20How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
NetBoxreadystack/netbox:v4.7.4-CE-ubuntu24.04-r1Who uses it, and whyWho: Network engineers and data centre operators who need an accurate record of their network infrastructure. Why: NetBox is a source of truth for network infrastructure. It models sites, racks, devices, cables, IP addresses, VLANs and circuits, and makes that data available through APIs to automation and monitoring tools. Use case: A network team tracks IP addresses in a spreadsheet and rack layouts in diagrams that drift out of date. In NetBox they record every site, rack, device, cable and prefix in one place, and their automation scripts read the intended state through the API instead of guessing it. |
Not available | A · 100 pushed and scanned 2026-11-01How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 234How it was scored
100 +4 = 104, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Nextcloudreadystack/nextcloud:v35.0.2-CE-ubuntu24.04-r4Who uses it, and whyWho: Households, companies and public organisations that want file sync and sharing, calendars and contacts on a server they choose. Why: Nextcloud stores files, contacts and calendars on your own server, keeps them in sync across devices, and lets you share them, with apps such as calendar, mail and video chat. Use case: A small firm wants its documents off personal laptops and in one place it controls. With Nextcloud each person's files sync between the server and their devices, projects get shared folders, and a client gets access to just the files meant for them. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 155How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
NGINXreadystack/nginx:1.31.8-CE-ubuntu24.04-r2Who uses it, and whyWho: Web developers and system administrators who serve websites and put applications behind a reverse proxy. Why: NGINX is an HTTP web server, reverse proxy, content cache and load balancer, and can also proxy TCP, UDP and mail traffic. Use case: A team serves a web application's pages and its API from the same address. NGINX serves the static files directly, terminates TLS, caches responses, and passes API requests to a pool of application servers with load balancing. |
Not available | A · 100 pushed and scanned 2026-11-05How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-04T06:20:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 72How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-05 | Defect log | Docker Hub Register Source and recipe |
NodeBBreadystack/nodebb:v4.16.5-CE-ubuntu24.04-r1Who uses it, and whyWho: Communities and organisations that want a modern discussion forum they host themselves. Why: NodeBB is forum software with real-time discussions and notifications, categories, user accounts and messaging, a read and write REST API, and plugins and themes for extra features. Use case: An open-source project runs its support forum on NodeBB. Questions sit in categories, new replies and notifications appear without reloading the page, the forum works on phones as well as desktops, and plugins add the integrations the project needs. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 84How it was scored
100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
OpenBaoreadystack/openbao:v2.7.2-CE-ubuntu24.04-r2Who uses it, and whyWho: Platform, security and DevOps teams who need to store, control and audit access to secrets, keys and certificates. Why: OpenBao is an identity-based secrets and encryption management system. It checks who each client is, hands out only the secrets its policy allows, and keeps detailed audit logs. Use case: A team's applications keep database passwords in configuration files. With OpenBao each application authenticates, receives only the secrets its policy allows, and can get database credentials generated on demand that are revoked when their lease ends, while every access is recorded. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 2 · M 82How it was scored
100 +12 = 112, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
OpenProjectreadystack/openproject:v17.9.4-CE-ubuntu24.04-r1Who uses it, and whyWho: Teams and organisations that plan and track projects and want their project data on their own servers. Why: OpenProject is web-based project management software for tasks, bugs, roadmaps, Gantt-chart scheduling, time tracking, wikis and meeting minutes in a single platform. Use case: A public agency runs several projects whose deadlines depend on each other. In OpenProject each project's work is planned on a Gantt chart, team members log the time they spend, meeting minutes sit next to the tasks, and the data stays on the agency's own servers. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 1349How it was scored
100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
OpenSearchreadystack/opensearch:3.9.0-CE-ubuntu24.04-r3Who uses it, and whyWho: Developers and operations teams who need full-text search, log analytics or vector search over large amounts of data. Why: OpenSearch is an open-source search and analytics suite for full-text search, application monitoring, log analytics and vector search, with OpenSearch Dashboards for visualisation and management. Use case: An online store wants full-text search across its product catalogue. It indexes the catalogue in OpenSearch and sends shoppers' queries there; the same cluster also stores the shop's application logs, which the operations team explores in OpenSearch Dashboards. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 148How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
OpenTelemetry Collectorreadystack/otelcol:v0.164.0-CE-ubuntu24.04-r1Who uses it, and whyWho: Platform and observability teams who collect traces, metrics and logs from many applications and send them to backends. Why: The OpenTelemetry Collector receives, processes and exports telemetry data in a vendor-agnostic way, so one agent or gateway can replace several separate collectors and agents. Use case: A team's services emit traces and metrics in different formats, and the team is weighing a new monitoring backend. Every service sends its data to an OpenTelemetry Collector, which processes it and exports it to the current backend and the trial one at the same time, with no change to the services. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 80How it was scored
100 +15 = 115, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Paperless-ngxreadystack/paperlessngx:v3.4.1-CE-ubuntu24.04-r1Who uses it, and whyWho: Households, freelancers and small offices who want to scan their paper and find any document again later. Why: Paperless-ngx turns scanned paper into a searchable online archive. It runs OCR on each document, files it with tags, correspondents and types it can learn to suggest, and keeps the data on your own server. Use case: A household scans its letters, bills and contracts as they arrive. Paperless-ngx reads each scan, adds searchable text, tags it with the sender and document type, and stores it as an archival PDF beside the original; when a warranty is needed years later, a full-text search finds it. |
Not available | A · 100 pushed and scanned 2026-11-01How it was scored
100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 810How it was scored
100 +7 = 107, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
pausereadystack/pause:3.10.2-CE-scratch-r1Who uses it, and whyWho: Kubernetes cluster administrators. It is not normally run by hand: the container runtime starts it for every pod. Why: The pause container is the infrastructure container of a pod. It starts first and keeps the pod's namespaces alive, so the pod's other containers can crash or restart without losing the pod's network setup. Use case: When a web pod's application container crashes and restarts, the pod keeps its IP address and network configuration, because the pause container still holds them. Administrators meet it mostly in the container runtime's settings, where its image is named as the sandbox image. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +23 = 123, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 1 · H 6 · M 12How it was scored
100 +20 = 120, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Perlreadystack/perl:5.44.0-CE-ubuntu24.04-r1Who uses it, and whyWho: System administrators, web developers and anyone who writes scripts that process text, files and data. Why: Perl is a general-purpose programming language, first built for text manipulation and now used for system administration, web development, network programming and more, with a large collection of third-party modules on CPAN. Use case: An administrator needs to pull errors out of large server logs every night and mail a summary. A short Perl script reads the logs, matches the lines with regular expressions, counts them per service and writes the report, using modules from CPAN for anything it does not do itself. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 67How it was scored
100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Portainerreadystack/portainer:2.45.3-CE-ubuntu24.04-r1Who uses it, and whyWho: Homelab operators, hobbyists, students and anyone experimenting with containers on their own hardware. Why: Portainer Community Edition is a free, lightweight web interface for managing containers on container hosts and Kubernetes. Use case: A hobbyist runs many self-hosted apps on a home server and loses track of them on the command line. Portainer shows every container on one web page, where they view its logs and statistics, open its console, and edit or remove it with a few clicks. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
B · 72 scanned 2026-11-06C 2 · H 5 · M 89How it was scored
100 −28 = 72. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
PostgreSQLreadystack/postgresql:18.6-CE-ubuntu24.04-r5Who uses it, and whyWho: Developers and database administrators who need a reliable relational database for applications of any size. Why: PostgreSQL is an open-source object-relational database that uses and extends SQL, known for reliability, data integrity and extensibility, with add-ons such as geospatial extensions. Use case: A team builds a booking application in which double bookings must never happen. PostgreSQL's transactions make each booking all-or-nothing, an exclusion constraint rejects overlapping bookings, and the same database stores flexible JSON details and answers the reporting queries. |
Not available | A · 100 pushed and scanned 2026-11-05How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-04T06:20:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 67How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-05 | Defect log | Docker Hub Register Source and recipe |
PostHogreadystack/posthog:master-20261022-b904ac8-CE-ubuntu24.04-r3Who uses it, and whyWho: Product teams and developers who want to see how people use their web or mobile app. Why: PostHog captures events from a product, automatically or through your own instrumentation, and lets you analyse user behaviour with visualisations or SQL. Use case: A team ships a new sign-up flow and wants to know where people drop out. PostHog records each step as an event; the team charts how many users reach each step, finds the screen where people give up, and checks the effect after changing it. |
Not available | A · 100 pushed and scanned 2026-11-02How it was scored
100 +16 = 116, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
B · 79 scanned 2026-11-06C 0 · H 2 · M 113How it was scored
100 −21 = 79. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-01 | Defect log | Docker Hub Register Source and recipe |
Prometheusreadystack/prometheus:v3.16.0-CE-ubuntu24.04-r1Who uses it, and whyWho: Operations, SRE and platform teams who monitor servers and services and alert on problems. Why: Prometheus is a monitoring system and time series database. It collects metrics from configured targets at intervals, stores them with labels, evaluates rules written in PromQL, and triggers alerts. Use case: A team runs web services that expose request counts and latencies. Prometheus discovers the services, collects their metrics at intervals, and fires an alert when the error rate of any service stays above its threshold for several minutes. |
Not available | A · 100 pushed and scanned 2026-11-06How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 73How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-06 | Defect log | Docker Hub Register Source and recipe |
Qdrantreadystack/qdrant:v1.20.0-CE-ubuntu24.04-r1Who uses it, and whyWho: Developers building semantic search, recommendations or retrieval for AI applications. Why: Qdrant is a vector database and similarity search engine. It stores vectors with a payload, finds the closest matches to a query vector, and filters results on the payload. Use case: A support team wants its help-centre search to find articles by meaning, not exact words. Each article is turned into an embedding and stored in Qdrant with its product and language; a user's question is embedded the same way, and Qdrant returns the closest articles for that product. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 79How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
RabbitMQreadystack/rabbitmq:4.4.0-CE-ubuntu24.04-r3Who uses it, and whyWho: Developers and operations teams who connect applications, microservices and IoT devices through messaging. Why: RabbitMQ is an open-source messaging and streaming broker. It supports several open protocols, including AMQP, MQTT and STOMP, and offers replicated queues and streams for data safety. Use case: A web shop must not lose orders when its invoicing service is slow or down. The shop publishes each order to a RabbitMQ queue, the invoicing service works through the queue at its own pace, and a replicated queue keeps the orders safe if a broker node fails. |
Not available | A · 100 pushed and scanned 2026-11-06How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 72How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-05 | Defect log | Docker Hub Register Source and recipe |
Rancherreadystack/rancher:v2.15.2-CE-ubuntu24.04-r3Who uses it, and whyWho: Organisations that deploy containers in production and run Kubernetes clusters in several places. Why: Rancher is an open-source container management platform. It provisions and manages Kubernetes clusters from one place, with central authentication, access control and monitoring across all of them. Use case: A company runs Kubernetes clusters in its own data centre and with a cloud provider. From Rancher, administrators create and upgrade the clusters, apply the same access policies to every team, and see each cluster's health in one view, while developers deploy their applications through its web interface. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
F · 0 scanned 2026-11-06C 0 · H 17 · M 121How it was scored
100 −143 = −43, held to 0 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Redashreadystack/redash:v26.9.0-CE-ubuntu24.04-r4Who uses it, and whyWho: Analysts and engineers who write SQL and want to share the results with the rest of their organisation. Why: Redash connects to many data sources. Users write SQL and other queries in the browser, turn the results into visualisations and dashboards, schedule refreshes and set alerts. Use case: An analyst keeps answering the same questions about weekly sign-ups. In Redash she writes the query once, charts it, adds it to a team dashboard that refreshes on a schedule, and sets an alert that notifies her when sign-ups fall below an expected level. |
Not available | A · 100 pushed and scanned 2026-10-31How it was scored
100 +16 = 116, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-31T06:18:17Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 92 scanned 2026-11-06C 0 · H 0 · M 109How it was scored
100 −8 = 92. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-31 | Defect log | Docker Hub Register Source and recipe |
Redisreadystack/redis:8.10.2-CE-ubuntu24.04-r3Who uses it, and whyWho: Developers building applications that need fast access to data: caches, sessions, queues, leaderboards and real-time features. Why: Redis is an in-memory data store and data structure server: strings, lists, sets, hashes, sorted sets, streams and JSON, with key expiry, pub/sub, and search and vector query features. Use case: A busy website keeps querying its main database for the same product pages and user sessions. With Redis in front, the site caches page data with an expiry time and stores sessions in memory, so most reads skip the main database and pages return faster. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 67How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
SeaweedFSreadystack/seaweedfs:4.52-CE-ubuntu24.04-r1Who uses it, and whyWho: Teams who need to store very large numbers of files, for applications, backups or analytics, on their own servers. Why: SeaweedFS is a simple, highly scalable distributed storage system. One server program offers an object store, a POSIX file system and table storage over the same data, and capacity grows by adding volume servers. Use case: A photo-sharing service stores huge numbers of small images that a single file server can no longer handle. SeaweedFS packs them into volumes spread across servers, reads each one with a single disk read, and grows by starting another volume server when space runs low. |
Not available | A · 100 pushed and scanned 2026-11-05How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 72How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-05 | Defect log | Docker Hub Register Source and recipe |
Syncthingreadystack/syncthing:v2.1.7-CE-ubuntu24.04-r2Who uses it, and whyWho: Individuals and small teams who want files synced between their own computers without a cloud service in between. Why: Syncthing continuously synchronises files between two or more computers in real time over encrypted, authenticated connections, with no central server that stores the data. Use case: A photographer edits on a desktop at home and travels with a laptop. Syncthing keeps the project folders on both in sync whenever the two can reach each other, so the latest edits are on whichever machine is at hand, and the files are never stored on anyone else's server. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 102How it was scored
100 +15 = 115, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
Temporeadystack/tempo:v3.1.1-CE-ubuntu24.04-r3Who uses it, and whyWho: Teams running many connected services who need distributed tracing to follow requests across them. Why: Grafana Tempo is a distributed tracing backend that needs only object storage to run. It stores traces from instrumented services, and teams explore them in Grafana to find slow or failing requests. Use case: Customers report that checkout is sometimes slow, and each checkout request passes through several services. Every service sends traces to Tempo; an engineer opens the slow traces in Grafana, sees which service call took most of the time, and knows where to look. |
Not available | A · 100 pushed and scanned 2026-10-30How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-30T06:23:28Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 2 · M 81How it was scored
100 +2 = 102, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Temporalreadystack/temporal:v1.32.1-CE-ubuntu24.04-r4Who uses it, and whyWho: Developers who build long-running, multi-step processes that must finish even when services crash. Why: Temporal is a durable execution platform. Its server runs units of application logic called Workflows so that they resume where they left off after crashes or outages, and it retries failed operations automatically. Use case: An online shop's order process charges a card, reserves stock, books a courier and emails the customer, and any step can fail. Written as a Temporal Workflow, the process retries a failed step, carries on after a server restart without losing its place, and can wait days for a delivery confirmation. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 89 scanned 2026-11-06C 0 · H 3 · M 104How it was scored
100 −11 = 89. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Traefikreadystack/traefik:v3.7.16-CE-ubuntu24.04-r1Who uses it, and whyWho: Teams running services on container platforms such as Kubernetes who want routing that follows services as they change. Why: Traefik is an HTTP reverse proxy and load balancer that reads your infrastructure, such as Kubernetes, and configures its routes automatically and dynamically, including HTTPS certificates. Use case: A team deploys new microservices to Kubernetes every week. Each service declares its host name in its own configuration; Traefik notices it, starts routing traffic to it and obtains a certificate for it, with no edits to a central proxy configuration. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 81How it was scored
100 +12 = 112, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Uptime Kumareadystack/uptimekuma:2.5.8-CE-ubuntu24.04-r3Who uses it, and whyWho: Individuals, small teams and IT administrators who want to know when their websites and services go down. Why: Uptime Kuma is an easy-to-use, self-hosted monitoring tool. It checks websites, ports, DNS records and containers at short intervals, sends notifications when something fails, and publishes status pages. Use case: A small agency hosts websites for its clients. Uptime Kuma checks each site and its certificate, notifies the team by email or chat when one stops responding, and gives each client a status page for their own site. |
Not available | A · 100 pushed and scanned 2026-10-31How it was scored
100 +19 = 119, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-30T06:23:28Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 92 scanned 2026-11-06C 0 · H 0 · M 91How it was scored
100 −8 = 92. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-31 | Defect log | Docker Hub Register Source and recipe |
Valkeyreadystack/valkey:9.1.3-CE-ubuntu24.04-r2Who uses it, and whyWho: Developers who need a key-value data store for caching, message queues, sessions and other real-time workloads. Why: Valkey is an open-source key-value datastore and data structure server, used for caching, message queues and as a primary database, with a plugin system for new data structures. Use case: A web application computes the same expensive results again and again. It stores each result in Valkey under a key with a timeout; later requests read the stored value instead of recomputing it, and Valkey deletes the entries when their timeout expires. |
Not available | A · 100 pushed and scanned 2026-11-06How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 60How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-05 | Defect log | Docker Hub Register Source and recipe |
Vaultwardenreadystack/vaultwarden:1.37.4-CE-ubuntu24.04-r4Who uses it, and whyWho: Families, small teams and self-hosters who want a password manager whose server they run themselves. Why: Vaultwarden is a lightweight, self-hosted password manager server. It implements another password manager's client API, so that manager's existing browser, desktop and mobile apps connect to it. Use case: A small office wants shared passwords out of spreadsheets. On Vaultwarden each person has a personal vault, the team shares logins through an organisation with collections, and everyone signs in with two-factor authentication from the apps they already use. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 79How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
VictoriaMetricsreadystack/victoriametrics:v1.155.0-CE-ubuntu24.04-r1Who uses it, and whyWho: Operations and SRE teams who store and query large volumes of monitoring metrics. Why: VictoriaMetrics is a time series database and monitoring solution, open source in both its single-node and cluster versions, with its own query language, MetricsQL. Use case: A company's monitoring has outgrown the local storage of its servers. Agents send metrics to a VictoriaMetrics cluster, which keeps them for long-term storage; dashboards query them with MetricsQL, and alert rules run against the same data. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 2 · M 81How it was scored
100 +2 = 102, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
virt-apireadystack/virtapi:v1.9.1-CE-debian12-r1Who uses it, and whyWho: Kubernetes cluster administrators who run virtual machines in their clusters with KubeVirt. Why: virt-api is KubeVirt's API server and the entry point for virtualisation requests. It fills in defaults for virtual machine definitions and validates them. Use case: When a user creates or changes a virtual machine in a cluster running KubeVirt, the request passes through virt-api, which applies default settings and rejects invalid definitions before they are stored as Kubernetes resources. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +23 = 123, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 1 · H 5 · M 12How it was scored
100 +7 = 107, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
virt-controllerreadystack/virtcontroller:v1.9.1-CE-debian12-r1Who uses it, and whyWho: Kubernetes cluster administrators who run virtual machines in their clusters with KubeVirt. Why: virt-controller holds KubeVirt's cluster-wide virtualisation logic. It watches virtual machine instances and creates and manages the pod that each one runs in. Use case: When a user starts a virtual machine, virt-controller sees the new instance and creates a pod for it; Kubernetes schedules that pod onto a node, and virt-controller records the node so the virt-handler there can start the VM. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +29 = 129, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 1 · H 5 · M 10How it was scored
100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
virt-exportproxyreadystack/virtexportproxy:v1.9.1-CE-debian12-r1Who uses it, and whyWho: Cluster administrators who move KubeVirt virtual machines and their disks out of a cluster. Why: virt-exportproxy is KubeVirt's export proxy. Virtual machine exports are downloaded through it, a dedicated server, so large disk transfers do not load the Kubernetes API server. Use case: An administrator wants to move a virtual machine into another cluster or system. They create an export for the VM, then download its disk images through the export proxy, which can be reached from outside the cluster through an Ingress or a NodePort service. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +29 = 129, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 1 · H 5 · M 10How it was scored
100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
virt-operatorreadystack/virtoperator:v1.9.1-CE-debian12-r1Who uses it, and whyWho: Kubernetes cluster administrators who run virtual machines in their clusters with KubeVirt. Why: virt-operator installs KubeVirt and manages the lifecycle of its core components: it deploys them when a KubeVirt resource is created and rolls out new versions when that resource or the operator is updated. Use case: An administrator adds virtual machine support to a cluster by applying the operator and then a KubeVirt resource, and virt-operator deploys the rest of KubeVirt. Later, an upgrade is a change to that resource, and virt-operator rolls out the new version while existing virtual machines keep running. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +26 = 126, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 1 · H 5 · M 11How it was scored
100 +10 = 110, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
virtctlreadystack/virtctl:v1.9.1-CE-scratch-r1Who uses it, and whyWho: Administrators and users who manage KubeVirt virtual machines from the command line. Why: virtctl is KubeVirt's command-line client. It adds what plain kubectl cannot do, such as serial and graphical console access, and shortcuts to start, stop and migrate virtual machines and upload disk images. Use case: An administrator's virtual machine stops answering on the network. With virtctl they open its serial console to see what the guest is doing, restart it if needed, and live-migrate it to another node before that node goes down for maintenance. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 1How it was scored
100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-29 | Defect log | Docker Hub Register Source and recipe |
Wiki.jsreadystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r3Who uses it, and whyWho: Teams and organisations that want a self-hosted wiki for their documentation, written in Markdown or a visual editor. Why: Wiki.js is open-source wiki software with Markdown, visual and HTML editors, version history on every page, search, and sign-in through local accounts or company systems such as LDAP, SAML and OpenID Connect. Use case: An engineering team writes its documentation in Markdown, while the support team prefers a visual editor. In Wiki.js both edit the same wiki, every change is tracked so a page can be compared or reverted, and staff sign in with their company accounts. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 101How it was scored
100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
WireGuardreadystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1Who uses it, and whyWho: Network administrators and individuals who need a simple, secure VPN between servers, sites or devices. Why: WireGuard is a simple, modern VPN that uses current cryptography. Peers authenticate each other by exchanging public keys, much like SSH keys, and the tunnel can roam between IP addresses. Use case: A small company needs staff laptops to reach servers on its office network. A WireGuard endpoint at the office holds each laptop's public key and allowed addresses; each laptop connects with a short configuration file, and the tunnel keeps working as the laptop moves between networks. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 2 · M 71How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Woodpeckerreadystack/woodpecker:v3.19.0-CE-ubuntu24.04-r2Who uses it, and whyWho: Development teams who want a lightweight, self-hosted CI/CD engine for the repositories on their Git server. Why: Woodpecker is a simple CI/CD engine. A workflow file in each repository lists the steps to build, test and deploy the code, and Woodpecker runs them on every change; plugins add common tasks. Use case: A small team hosts its own Git server and wants tests on every push. With Woodpecker connected to it, each repository's workflow file runs on every change: the code is tested, the application is built, and it is deployed when the main branch passes. |
Not available | A · 100 pushed and scanned 2026-10-27How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 102How it was scored
100 +15 = 115, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
WordPressreadystack/wordpress:7.1.4-CE-ubuntu24.04-r1Who uses it, and whyWho: Bloggers, small businesses, publishers and organisations who build and run websites. Why: WordPress is open-source publishing software for websites and blogs. Write and schedule posts and pages, manage media and users with roles, and extend the site with themes and plugins. Use case: A local business wants a website its staff can update without a developer. With WordPress they pick a theme, the owner writes and schedules news posts, an editor manages the pages and images, and plugins add a calendar and spam protection for comments. |
Not available | A · 100 pushed and scanned 2026-11-05How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 148How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-11-05 | Defect log | Docker Hub Register Source and recipe |
Zabbixreadystack/zabbix:7.4.16-CE-ubuntu24.04-r2Who uses it, and whyWho: IT operations teams who monitor networks, servers, virtual machines, applications and cloud services. Why: Zabbix is an open-source distributed monitoring solution. It discovers devices, collects metrics with or without agents, detects problems, sends alerts, and shows the data in graphs, maps and dashboards. Use case: An IT team looks after switches, servers and databases across several offices. Zabbix discovers the devices, applies ready-made templates to monitor them, raises a problem when a disk fills or a link drops, and notifies the on-call administrator, including for offices behind firewalls. |
Not available | A · 100 pushed and scanned 2026-10-28How it was scored
100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 0 · M 103How it was scored
100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-27 | Defect log | Docker Hub Register Source and recipe |
ZITADELreadystack/zitadel:v4.20.0-CE-ubuntu24.04-r1Who uses it, and whyWho: Developers building SaaS and business-to-business applications who need login, single sign-on and multi-tenancy. Why: ZITADEL is an open-source identity and access management platform with single sign-on over OpenID Connect and SAML, multi-factor login and passkeys, multi-tenancy, an audit trail of all events, and APIs. Use case: A software company sells its application to other businesses, each wanting its own branding and users. In ZITADEL each customer is an organisation with its own branded login and self-service user management, and the application signs everyone in through OpenID Connect. |
Not available | A · 100 pushed and scanned 2026-10-29How it was scored
100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
A · 100 scanned 2026-11-06C 0 · H 1 · M 83How it was scored
100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower). |
Rebuilt bit-for-bit, 2026-10-28 | Defect log | Docker Hub Register Source and recipe |
Need a whole platform?
What a platform stack isSome software is many parts: host programs and container images whose versions must match, installed together across several machines, such as a Kubernetes cluster that runs virtual machines. We build the matched set as a platform stack: every part built with the network off from pinned upstream source and packages, signed, installable with no internet from a local registry, and tested together across several machines.
The first one is published: the Kubernetes VM Stack, virtual machines on a three-node Kubernetes cluster. Its page lists every part and how the stack was tested before release.