Docker 29.9.3-CE-ubuntu24.04-r2 build trail

How ReadyStack built readystack/docker:29.9.3-CE-ubuntu24.04-r2 and its build kit, copied record by record: why the release exists, every chain, drive and stage it went through, the model work, the review rounds, the defects, the checks that verified it and when it was published. Each line names the record it comes from in brackets; a record that does not exist for this release says so.

This trail

As JSON
  • Imagereadystack/docker:29.9.3-CE-ubuntu24.04-r2
  • Index digestsha256:881ec3d97eb17085e859e38685f3e8e85468dda98529e75bd45cc6a0b62b62a7
  • linux/amd64 digestsha256:fd07c8c45afca8162e4ea6f1daef1da648405c85676c4c50c62edde49406df28
  • ArchiveReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.tar.gz
  • Archive SHA-256 nowd18c93f63512ccfba04b532cb097795a16a30fb42891a9ef0b10826856f89db7
  • Pins recorddocs/PINS.md, docs/provenance/PINS.json in the archive (since generated)
  • Generated2026-11-09T11:24:15Z by KitForge release/build_trail.py
  • Sections9 sections, 8 fully recorded; 1 item not recorded

Signed with the release key The trail's signature is a Sigstore bundle beside it. Check it is ours before you rely on it:

cosign verify-blob --key https://readystack.dev/keys/cosign.pub \
  --bundle ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.trail.json.sigstore ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.trail.json
ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.trail.jsonReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.trail.json.sigstoreReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.trail.mdDocker product page

IdentityWhy this release existsThe path through the harnessModel work per stageReviewDefectsVerificationPublicationPackages and CPU level

Identity

Fully recorded
  • ProductDocker (docker) [MANIFEST.json]
  • Release tag29.9.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Imagereadystack/docker:29.9.3-CE-ubuntu24.04-r2 [MANIFEST.json]
  • Image index digestsha256:881ec3d97eb17085e859e38685f3e8e85468dda98529e75bd45cc6a0b62b62a7 [docs/provenance/LOCKED_DIGEST.txt]
  • linux/amd64 image digestsha256:fd07c8c45afca8162e4ea6f1daef1da648405c85676c4c50c62edde49406df28 [ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.rebuild.json, subject.image_manifest_digest]
  • ArchiveReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.tar.gz (bytes 544504503) [MANIFEST.json]
  • Archive sha256 at publishd18c93f63512ccfba04b532cb097795a16a30fb42891a9ef0b10826856f89db7 [MANIFEST.json, tarball_sha256]
  • Archive records agreeyes [MANIFEST.json, PUBLISH_MANIFEST.json and .cutover.json name the same sha256]
  • Repack historynone: the archive is as first published [MANIFEST.json, repack_history]
  • Upstream repositoryhttps://github.com/moby/moby [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream refdocker-v29.9.3 [docs/provenance/SOURCE_TREE_HASH.json]
  • Upstream commit70efc0e31da3a115fc87574d1b786fa2b867c346 [docs/provenance/SOURCE_TREE_HASH.json]
  • Source tree hash1522968c9e870c03f7043fad70e053af57e8232ac20afd818a5c171795954af3 (files 13291) [docs/provenance/SOURCE_TREE_HASH.json, tree_listing_sha256 (sha256 of the sorted file listing)]
  • Kit tree hashsha256:3d62acfa6615c529ee935ca1bdbe9298f0b724197293e56f40f344dc21b85c78 [ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.rebuild.json, inputs.tree_hash]
  • SOURCE_DATE_EPOCH1793741612 (utc 2026-11-03T21:33:32Z) [ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.rebuild.json, inputs.source_date_epoch]
  • Base images
    • ref golang:1.26.10-bookworm@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af · platform digest sha256:88750ccdd0f2a77fcc00a14b1a48d6409bd8ddb5d7c2dd6ec0b4a2e916daf9d9
    • ref ubuntu:24.04@sha256:fe81560990fae86dc4743202b2cb4d3df98d0bcf949173cecef15ce1127ef852 · platform digest sha256:78d4744ead1f5b19b04d0df558ab182a5300903900755e515b2ca4d10eb2044d
    [ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.rebuild.json, bases]
  • BuildKitmoby/buildkit:v0.31.2 (image digest sha256:e0e67ea9c4bb07bdef683e29f70f3b623d1eb9c82274a9ec04e6bb0511449fb0) [ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.rebuild.json, engine]
  • Engine commit(s)
    • commit 55866b6001949e70404e9d5146b06b3d82f15175 · dirty yes · first drive 3981
    • commit bfc2c69cad25a084895a177f0ea769362fac34dc · dirty yes · first drive 3994
    • commit 689d6317d30e65d62baa6df3341eadc3f62cb7de · dirty yes · first drive 3997
    • commit 678397f6b48cf9373310259de6add88729f870b0 · dirty yes · first drive 4003
    [drive_runs, engine_sha]

Why this release exists

Fully recorded
  • Chain916 (created 2026-11-09T08:10:36Z · trigger customer_request · upstream version 29.9.3) [chains, chains #916]
  • Requestbuild request #558 (rebuild) (requested at 2026-11-08T05:20:31Z · requested by kitforge-agent · version 29.9.3) [build_requests, build_requests #558]
  • Reasonrevision 29.9.3-CE-ubuntu24.04-r2: same upstream version rebuilt on the chiselled runtime (slim base; retarget.py --rev-bump) [build_requests, build_requests #558 request_reason]
  • Supersedesreadystack/docker:29.9.3-CE-ubuntu24.04-r1 (chain 828) [chains, chains #828]

The path through the harness

Fully recorded

1 chain · 4 drives · 18 stages · 3 rewinds

Chain 916 release · ready_to_ship

Created 2026-11-09T08:10:36Z, upstream 29.9.3, build request 558 [chains, chains #916]

DriveStartedMinutesBuild hostHow it stopped
39812026-11-09T08:11:04Z45.5build host 2 withhold-publish ready_to_ship at package_archive; 19 ticks [drive_runs, drive_runs #3981]
39942026-11-09T10:10:32Z4.6build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3994]
39972026-11-09T10:45:09Z4.3build host 2 withhold-publish ready_to_ship at package_archive; 2 ticks [drive_runs, drive_runs #3997]
40032026-11-09T11:18:01Z—build host 2 publish-held not recorded [drive_runs, drive_runs #4003]

Stages, in order

StageFirst startPassedAttemptsGate checks passedArtifacts (SHA-256)
intake 2026-11-09T08:11:14Z2026-11-09T08:11:15Z1
4
  • exists:order_json
  • order_json:json_parses
  • order_json:no_forbidden_placeholders
  • produces_paths_exist
 order_json f12700d46b92…
acquire 2026-11-09T08:11:34Z2026-11-09T08:11:35Z1
12
  • exists:source_tree
  • exists:source_tree_hash
  • exists:source_file_manifest
  • exists:custody_inputs
  • exists:license_file
  • source_tree:dir_nonempty
  • source_tree_hash:json_parses
  • source_file_manifest:json_parses
  • custody_inputs:json_parses
  • license_file:file_nonempty
  • produces_paths_exist
  • custody_inputs:json_true:ce_audit.ce_only
 source_tree 34d31f95d767…
license_file 7c87873291f2…
custody_inputs c66c69893c72…
source_tree_hash 41d1f0053b97…
source_file_manifest 05395af24ee5…
plan 2026-11-09T08:12:17Z2026-11-09T08:12:18Z1
10
  • exists:recon_report
  • exists:input_pin_plan
  • exists:toolchain_lock
  • recon_report:md_min_sections:3
  • recon_report:no_forbidden_placeholders
  • input_pin_plan:md_min_sections:2
  • input_pin_plan:no_forbidden_placeholders
  • toolchain_lock:file_nonempty
  • toolchain_lock:no_forbidden_placeholders
  • produces_paths_exist
 recon_report aeb5ce2edd8a…
input_pin_plan 65f3c5bbb02e…
toolchain_lock 9d9e8a2a2117…
assemble_kit 2026-11-09T08:18:07Z2026-11-09T08:18:08Z1
27
  • exists:dockerfile
  • exists:base_image_digests
  • exists:system_pinning
  • exists:build_recipe
  • exists:first_build_digest
  • exists:first_boot_health
  • exists:dockerfile_offline
  • exists:verify_offline_sh
  • exists:build_offline_sh
  • exists:generate_sbom_sh
  • dockerfile:file_nonempty
  • dockerfile:no_forbidden_placeholders
  • base_image_digests:file_nonempty
  • system_pinning:file_nonempty
  • build_recipe:json_parses
  • first_build_digest:file_nonempty
  • first_boot_health:file_nonempty
  • dockerfile_offline:file_nonempty
  • dockerfile_offline:no_forbidden_placeholders
  • verify_offline_sh:file_nonempty
  • verify_offline_sh:no_forbidden_placeholders
  • build_offline_sh:file_nonempty
  • build_offline_sh:no_forbidden_placeholders
  • generate_sbom_sh:file_nonempty
  • generate_sbom_sh:no_forbidden_placeholders
  • produces_paths_exist
  • first_boot_health:file_contains:healthy=True
 dockerfile 6f07c9010f90…
build_recipe 3bc16c483be2…
system_pinning aa8db05a9a8a…
build_offline_sh 6633aa31b6b4…
generate_sbom_sh ce0f1e6f1e70…
first_boot_health ddde9226ba80…
verify_offline_sh 3e8184ea230c…
base_image_digests 0a9229258091…
dockerfile_offline 6f07c9010f90…
first_build_digest 07b76b204456…
remediate 2026-11-09T08:18:49Z2026-11-09T08:18:50Z1
8
  • exists:vendored_apt
  • exists:remediation_log
  • exists:security_report
  • vendored_apt:dir_exists
  • remediation_log:json_parses
  • security_report:md_min_sections:2
  • security_report:no_forbidden_placeholders
  • produces_paths_exist
 vendored_apt e3b0c44298fc…
remediation_log 217e7fe909ef…
security_report 2961c64a2d6f…
build_kit 2026-11-09T08:27:16Z2026-11-09T08:27:17Z1
9
  • exists:freeze_manifest
  • exists:locked_digest
  • exists:cosign_stamp
  • exists:offline_rebuild_transcript
  • freeze_manifest:json_parses
  • locked_digest:file_nonempty
  • cosign_stamp:file_nonempty
  • offline_rebuild_transcript:json_parses
  • produces_paths_exist
 cosign_stamp 926a40242301…
locked_digest dded645c0ec4…
freeze_manifest edc0fa5fb1e5…
offline_rebuild_transcript c67c5f7e6e87…
verdict 2026-11-09T08:28:13Z2026-11-09T08:28:14Z1
8
  • exists:scout_verdict
  • scout_verdict:json_parses
  • produces_paths_exist
  • scout_verdict:release_check_passed
  • scout_verdict:nonroot_green
  • scout_verdict:zero_fixable_crit_high
  • scout_verdict:osv_clean
  • scout_verdict:no_baked_secrets
 scout_verdict f4371320e6c2…
publish_image 2026-11-09T08:28:51Z2026-11-09T08:28:52Z1
7
  • exists:promotion_record
  • exists:hub_readme
  • promotion_record:json_parses
  • hub_readme:md_min_sections:2
  • hub_readme:no_forbidden_placeholders
  • produces_paths_exist
  • promotion_record:json_true:signed
 hub_readme feef7c19578c…
promotion_record 7472de460208…
boot_instance 2026-11-09T08:29:04Z2026-11-09T08:29:08Z2
3
  • exists:instance_handle
  • instance_handle:json_parses
  • produces_paths_exist
 instance_handle 19e3c4c5136f…
sbom 2026-11-09T08:29:23Z2026-11-09T08:29:24Z1
5
  • exists:sbom_json
  • exists:sbom_md
  • sbom_json:json_parses
  • sbom_md:md_min_sections:1
  • produces_paths_exist
 sbom_md de07192ae94a…
sbom_json 95ba988e6d62…
schema_discovery 2026-11-09T08:29:26Z2026-11-09T08:29:27Z1
7
  • exists:dependency_tree
  • exists:table_classification
  • exists:schema_hash
  • dependency_tree:json_parses
  • table_classification:json_parses
  • schema_hash:file_nonempty
  • produces_paths_exist
 schema_hash 5a61d0274ca1…
dependency_tree 5ab347e0ef03…
table_classification 2b3a4a48b186…
admin_handbook 2026-11-09T08:34:32Z2026-11-09T08:34:33Z1
7
  • exists:admin_handbook
  • exists:api_map
  • admin_handbook:md_min_sections:10
  • admin_handbook:no_forbidden_placeholders
  • api_map:json_parses
  • produces_paths_exist
  • admin_handbook:command_transcripts_clean
 api_map 5fba8e59ab4f…
admin_handbook fa6445e82dd9…
db_handbook 2026-11-09T08:41:08Z2026-11-09T08:41:09Z1
8
  • exists:db_handbook
  • exists:seed_isolation
  • db_handbook:md_min_sections:5
  • db_handbook:no_forbidden_placeholders
  • seed_isolation:md_min_sections:1
  • seed_isolation:no_forbidden_placeholders
  • produces_paths_exist
  • db_handbook:command_transcripts_clean
 db_handbook 70a5058f9524…
seed_isolation 7cc2ae0e5729…
seed_data 2026-11-09T08:41:17Z2026-11-09T08:41:18Z1
6
  • exists:seed_data_sql
  • exists:seed_cases_json
  • seed_data_sql:sql_parses
  • seed_data_sql:no_forbidden_placeholders
  • seed_cases_json:json_parses
  • produces_paths_exist
 seed_data_sql 5954dfebc0e4…
seed_cases_json 5a581597b11c…
seed_validate 2026-11-09T08:41:20Z2026-11-09T08:41:21Z1
3
  • exists:seed_data_contract
  • seed_data_contract:json_parses
  • produces_paths_exist
 seed_data_contract 8dc05e1afc03…
usecase_validate 2026-11-09T08:41:44Z2026-11-09T08:41:45Z1
10
  • exists:usecase_contract
  • exists:passed_tests
  • exists:failed_tests
  • exists:test_results
  • usecase_contract:json_parses
  • passed_tests:md_min_sections:1
  • failed_tests:md_min_sections:1
  • test_results:json_parses
  • produces_paths_exist
  • test_results:usecase_thresholds:80,70
 failed_tests b2247b16f5f7…
passed_tests 491d53d9d20d…
test_results 9f5a5df2a8be…
usecase_contract 5f15c651d800…
finalize_docs 2026-11-09T08:46:52Z2026-11-09T08:46:53Z1
9
  • exists:api_integration_guide
  • exists:release_notes
  • exists:defects_json
  • api_integration_guide:md_min_sections:3
  • api_integration_guide:no_forbidden_placeholders
  • release_notes:md_min_sections:3
  • release_notes:no_forbidden_placeholders
  • defects_json:json_parses
  • produces_paths_exist
 defects_json 72a68d5eb809…
release_notes 67e66b1c8414…
api_integration_guide d28dd40f6aaa…
package_archive invalidated 2026-11-09T11:17:34Z 2026-11-09T08:56:33Z2026-11-09T10:49:29Z3
35 (final gate PASS)
  • exists:checksums
  • exists:verify_md
  • exists:rebuild_md
  • exists:provenance_md
  • exists:manifest_txt
  • exists:assetchain_log_md
  • exists:assetchain_log_json
  • exists:actions_jsonl
  • exists:sale_tar
  • checksums:file_nonempty
  • verify_md:md_min_sections:2
  • verify_md:no_forbidden_placeholders
  • rebuild_md:md_min_sections:2
  • rebuild_md:no_forbidden_placeholders
  • provenance_md:md_min_sections:2
  • provenance_md:no_forbidden_placeholders
  • manifest_txt:file_nonempty
  • assetchain_log_md:md_min_sections:1
  • assetchain_log_json:json_parses
  • actions_jsonl:file_nonempty
  • sale_tar:file_nonempty
  • produces_paths_exist
  • G8 cosign
  • G8 scan_grade
  • G8 tag_base_os
  • G8 thread_exit
  • G8 vex_shipped
  • G8 cpu_baseline
  • G8 scout_grade_a
  • G8 script_copies
  • G8 offline_rebuild
  • G8 rebuild_manifest
  • G8 artifact_coverage
  • G8 trademark_shipped
  • G8 assetchain_coverage
 sale_tar ed0d0c7a2a44…
checksums b46e43071b0e…
verify_md f72c78f736bb…
rebuild_md 3bdf6f8cd2ca…
manifest_txt 9c00dcb86769…
actions_jsonl 7ffd54eaf70c…
provenance_md dea225d4ec9c…
assetchain_log_md e9eccaec0c0f…
assetchain_log_json 6a46a4c19e4a…

[stage_runs]

Rewinds

  • 2026-11-09T09:27:50Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28579]
  • 2026-11-09T10:38:25Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28709]
  • 2026-11-09T11:17:34Z: package_archive to package_archive on docs_redo (scripts/redo-docs.py --stage package_archive) [stage_events, stage_events #28774]

Model work per stage

Fully recorded

Role: writer model. Calls up to 2026-11-09T10:49:29Z.

75 calls over 5 stages

StageCallsRefusedErrorsMax attemptForced commitsReal tokensLesson rules shown
plan2001 011536 L-A183, L-A15
remediate2001 012585 L-A183, L-A15
admin_handbook22402 0131144 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15, L-A14
db_handbook28603 2178303 L-A180, L-A181, L-A182, L-A183, L-A184, L-A114, L-A15
finalize_docs21102 0127336 L-A180, L-A181, L-A182, L-A183, L-A184, L-A155, L-A114, L-A25, L-A15

[micro_step_runs] [lesson_recalls]

Review

Fully recorded

Role: review model.

3 rounds, 3 counted, $5.64 recorded cost

RoundStartedCriticalMajorMinorVerdictCostCap in forceArchive reviewed
12026-11-09T08:58:47Z 0118 findings to repackage [held_rounds, held_rounds #1601] $2.03 3 rounds, $40.00 92aa85ad18d3…
22026-11-09T10:15:49Z 019 findings to repackage [held_rounds, held_rounds #1607] $1.86 3 rounds, $40.00 3fc42bc0f32e…
32026-11-09T10:50:09Z 004 clean to publish [held_rounds, held_rounds #1608] $1.75 3 rounds, $40.00 ed0d0c7a2a44…

Defects

Fully recorded
  • Ledger entries33 [defects, defects where product_slug=docker and this tag or chain]
  • Disclosed in the archive33 [docs/defects/defects.json, entries]

33 ledger entries: by severity low 22, high 11; by status fixed-before-release 33.

DefectSeverityStatusFound byFixed in
RSD-docker-97615df26c
Admin handbook: IMAGE_CONFIG.json Volumes = {/home/rootless/.local/share/docker} only; /certs is not declared, the run command mounts it. [defects, defects #202479]		lowfixed-before-releaseheld review (review model)—
RSD-docker-0f177e9a91
Admin handbook: Admin handbook says the container name `dind` is a name the server certificate covers; it is not. [defects, defects #202491]		highfixed-before-releaseheld review (review model)—
RSD-docker-b69cc46042
Admin handbook: The CA certificate path /certs/ca/ca.pem does not exist; the handbook's own other sections give /certs/ca/cert.pem. [defects, defects #202492]		highfixed-before-releaseheld review (review model)—
RSD-docker-1a161c59f7
Admin handbook: Custom-certificate instruction is wrong: the presence of /certs/server is not what stops regeneration; /certs/ca/key.pem must be absent and all three files present. [defects, defects #202493]		highfixed-before-releaseheld review (review model)—
RSD-docker-0b9acef89e
Admin handbook: Omits the required absence of /certs/ca/key.pem; on a /certs volume that already ran, the entrypoint overwrites the supplied certificates. [defects, defects #202494]		highfixed-before-releaseheld review (review model)—
RSD-docker-f0bdbad46b
Admin handbook: CI job-container example mounts the whole certs volume at /certs/client, so the job container finds no ca.pem/cert.pem/key.pem at DOCKER_CERT_PATH=/certs/client. [defects, defects #202495]		highfixed-before-releaseheld review (review model)—
RSD-docker-1ed5f4fa87
Admin handbook: 'mounted socket' is unsupported: the socket lives in /run/user/1000 (not a volume) and no document or record shows it shared. [defects, defects #202496]		lowfixed-before-releaseheld review (review model)—
RSD-docker-4b907eab4b
Admin handbook: Wrong customer-visible error for a git-URL build. [defects, defects #202497]		lowfixed-before-releaseheld review (review model)—
RSD-docker-8874e0a705
Database handbook: DB handbook says the container name `dind` is covered by the server certificate; it is not. [defects, defects #202498]		highfixed-before-releaseheld review (review model)—
RSD-docker-a91b4067d6
Database handbook: Example DOCKER_HOST uses tcp://dind:2376, a name the certificate does not cover (fails TLS verification); the API guide's line 413 says exactly this fails. [defects, defects #202499]		highfixed-before-releaseheld review (review model)—
RSD-docker-c4d9f34fb2
Database handbook: States the opposite of the entrypoint's behaviour for operator-supplied certificates, and of the DB handbook's own line 431/646. [defects, defects #202500]		highfixed-before-releaseheld review (review model)—
RSD-docker-1412e8a0cd
Database handbook: Wrong place and condition for operator certificates: files are not placed in /certs/ca (which holds cert.pem and key.pem), and /certs/ca/key.pem must be absent. [defects, defects #202501]		highfixed-before-releaseheld review (review model)—
RSD-docker-457bc1ccdc
Database handbook: The entrypoint generates /certs/server by default; it is not only for operator-supplied certificates. [defects, defects #202502]		lowfixed-before-releaseheld review (review model)—
RSD-docker-b327f12768
Database handbook: Backup command run as written is executed by the host's Docker (no `docker exec dind`): it archives the host's dind-data volume (the inner daemon's raw data directory, live) with an image the inner… [defects, defects #202503]		highfixed-before-releaseheld review (review model)—
RSD-docker-53cee7b71a
Database handbook: Wrong customer-visible error for a git-URL build. [defects, defects #202504]		lowfixed-before-releaseheld review (review model)—
RSD-docker-8f960b3ef4
API guide: Contradicts the same guide (line 291, 473) and the entrypoint: a non-dash first argument is exec'd as the command. [defects, defects #202505]		lowfixed-before-releaseheld review (review model)—
RSD-docker-8fcb631803
API guide: A /certs volume does not avoid re-issuing; the guide's own previous sentence says certificates are re-issued each start. [defects, defects #202506]		lowfixed-before-releaseheld review (review model)—
RSD-docker-e9698f6d57
API guide: Omits the required absence of /certs/ca/key.pem (stated correctly at line 382/483). [defects, defects #202507]		lowfixed-before-releaseheld review (review model)—
RSD-docker-80cbff783f
API guide: tini is listed among components compiled from vendored Go module trees; it is a C program taken from Ubuntu's tini-static package. [defects, defects #202508]		lowfixed-before-releaseheld review (review model)—
RSD-docker-6205e08867
Database handbook: With operator-supplied certificates the entrypoint issues no client certificate; the sentence tells the customer one will be issued, and /certs/client does not exist. [defects, defects #204112]		highfixed-before-releaseheld review (review model)—
RSD-docker-812df18254
API guide: Contradicts the previous sentence of the same paragraph (new certificates at each start); the volume keeps the CA key, not the certificates. [defects, defects #204113]		lowfixed-before-releaseheld review (review model)—
RSD-docker-46b5f2bb63
Admin handbook: A /certs volume does not avoid re-issuing; the handbook's own lines 156/447 say certificates are re-issued at every start. [defects, defects #204114]		lowfixed-before-releaseheld review (review model)—
RSD-docker-c95ed36e6a
Database handbook: Certificates are not reused; only the CA key is (the DB handbook's own lines 431/857 say re-issued at every start). [defects, defects #204115]		lowfixed-before-releaseheld review (review model)—
RSD-docker-03611c87f1
Admin handbook: On a restart of the same container the CA key persists in its filesystem and previously copied client certificates keep working; only a re-created container gets a new CA. [defects, defects #204116]		lowfixed-before-releaseheld review (review model)—
RSD-docker-5f5064d084
Database handbook: slirp4netns provides the network device; published ports are bound by rootlesskit's builtin port driver, as the rest of the handbook says. [defects, defects #204117]		lowfixed-before-releaseheld review (review model)—
RSD-docker-ee95d57a02
Database handbook: Run from inside the outer container, $(pwd) is a container path and the mount succeeds; it fails only when the host shell expands it. [defects, defects #204118]		lowfixed-before-releaseheld review (review model)—
RSD-docker-a50741a42e
Admin handbook: A host directory mounted into the outer container can be bind-mounted into an inner container. [defects, defects #204119]		lowfixed-before-releaseheld review (review model)—
RSD-docker-b819a9cdb9
API guide: The stated cause (user-namespace permission restriction) and the absolute claim are wrong; the bind mount works through an outer -v. [defects, defects #204120]		lowfixed-before-releaseheld review (review model)—
RSD-docker-28dd5069d0
API guide: Absolute claim contradicted by the measured outer -v route. [defects, defects #204121]		lowfixed-before-releaseheld review (review model)—
RSD-docker-d91d0be5eb
Database handbook: Paraphrase of the round-2 finding: says certificates are not re-issued when /certs is a volume, but the entrypoint re-issues the CA, server and client certificates at every start and only the keys… [defects, defects #204799]		lowfixed-before-releaseheld review (review model)—
RSD-docker-895ab7b08f
Database handbook: The CA certificate file is not preserved: it is re-issued at every start (new serial and fingerprint); the CA key is what the volume preserves. [defects, defects #204800]		lowfixed-before-releaseheld review (review model)—
RSD-docker-2ed8b4340e
Database handbook: Same paraphrase: the CA certificate is regenerated at every start; only the CA key persists. [defects, defects #204801]		lowfixed-before-releaseheld review (review model)—
RSD-docker-ebefa0de1f
API guide: Says an inner container cannot use --network host, which is false and contradicts the next sentence and API_INTEGRATION_GUIDE.md:149/747/1003. [defects, defects #204802]		lowfixed-before-releaseheld review (review model)—

Verification

1 item not recorded
  • Reproduced before publishingyes (rebuilt digest sha256:fd07c8c45afca8162e4ea6f1daef1da648405c85676c4c50c62edde49406df28 · published digest sha256:fd07c8c45afca8162e4ea6f1daef1da648405c85676c4c50c62edde49406df28 · digest match yes · builder moby/buildkit:v0.31.2 · build seconds 240) [docs/provenance/REPRO_VERIFICATION.json, verified]
  • Final contract gate (G8)PASS (checks artifact_coverage, assetchain_coverage, cosign, cpu_baseline, offline_rebuild, rebuild_manifest, scan_grade, scout_grade_a, script_copies, tag_base_os, thread_exit, trademark_shipped, vex_shipped) [g8_result.json, result]
  • Grade at releaseA (percent 94 · tool docker scout policy 1.26.0 · config docker-default · org vex no · at 2026-11-09T11:18:26Z · failing Docker Scout counts 62 packages with copyleft licences (GPL, LGPL, MPL), all of them operating-system packages (it counts only packages whose licence it can read; the SBOM lists every component).) [SCOUT_EVIDENCE.json, docker_scout_policy]
  • Image signatureverified on the index and the linux/amd64 manifest (key fingerprint 04daa92344a52dbc · at 2026-11-09T11:18:11Z) [docs/provenance/IMAGE_EVIDENCE.json, signed]
  • Image signature transparency-log entries [deliverables/provenance/PROMOTION_RECORD.json, sign_stdout_tail]
  • rebuild.json signatureSigstore bundle, release key (key fingerprint 04daa92344a52dbc · log index 3763900755 · transparency-log entry · integrated 2026-11-09T11:22:49Z) [ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.rebuild.json.sigstore, verificationMaterial.tlogEntries[0]]
  • Signed attestations
    • kind provenance · digest sha256:881ec3d97eb17085e859e38685f3e8e85468dda98529e75bd45cc6a0b62b62a7 · state attached · log index 3763906281 · transparency-log entry
    • kind sbom · digest sha256:881ec3d97eb17085e859e38685f3e8e85468dda98529e75bd45cc6a0b62b62a7 · state attached · log index 3763908638 · transparency-log entry
    • kind vsa · digest sha256:881ec3d97eb17085e859e38685f3e8e85468dda98529e75bd45cc6a0b62b62a7 · state attached · log index 3763911569 · transparency-log entry
    • kind provenance · digest sha256:fd07c8c45afca8162e4ea6f1daef1da648405c85676c4c50c62edde49406df28 · state attached · log index 3763913838 · transparency-log entry
    • kind sbom · digest sha256:fd07c8c45afca8162e4ea6f1daef1da648405c85676c4c50c62edde49406df28 · state attached · log index 3763916287 · transparency-log entry
    • kind vsa · digest sha256:fd07c8c45afca8162e4ea6f1daef1da648405c85676c4c50c62edde49406df28 · state attached · log index 3763919392 · transparency-log entry
    (at 2026-11-09T11:22:50Z) [attestations.json, results]
  • Pins recorddocs/PINS.md and docs/provenance/PINS.json in the archive (https://readystack.dev/products/docker/recipe) [docs/provenance/PINS.json]

Offline clean-room rebuilds

  • 2026-11-09T08:58:52Z on build host 2 (Docker-in-Docker daemon with --network none): bit for bit yes, digest match yes, customer verify yes
    rebuilt sha256:fd07c8c45afca8162e4ea6f1daef1da648405c85676c4c50c62edde49406df28 [clean-room rebuild ledger, runs[691]]
  • Not recorded: the policy tool's --result-file itself (its per-policy results are copied into SCOUT_EVIDENCE.json and the archive's IMAGE_EVIDENCE.json; the file is not kept)

Publication

Fully recorded 1 pending at generation
  • Image pushed (internal tag), publish_image passed2026-11-09T08:28:52Z [stage_runs, stage_runs chain 916 stage publish_image]
  • Archive manifests written2026-11-09T11:20:30Z [PUBLISH_MANIFEST.json, published_at]
  • Pending at generation: the archive cut-over on prodasset, the release tag's promotion and the site event (this trail was generated after G8 and before them; they are appended as a 'publication' event in History)

Packages and CPU level

Fully recorded
  • x86-64 level the image needsv1 (used v4 · baseline v2 · elf files 365 · probed 2026-11-09T08:22:58Z · source build_kit) [release_images, isa_level_hard]

History

2 events
  • 2026-11-09T11:24:15Z generated: by KitForge release/build_trail.py · generator commit 00407557b9a4b38773691c3329e4cb8e20f5c597
  • 2026-11-09T11:25:54Z publication: promoted at 2026-11-09T11:24:53Z · promoted digest sha256:881ec3d97eb17085e859e38685f3e8e85468dda98529e75bd45cc6a0b62b62a7 · promotion method imagetools_create_retag_by_digest_no_rebuild · site event 412 · checklist status complete · checklist at 2026-11-09T11:25:54Z · record workspace: deliverables/provenance/PROMOTION_RECORD.json, RELEASE_CHECKLIST.json

Records

25 records
RecordWhere it isRows
docs/defects/defects.jsoninside the archive (ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/IMAGE_EVIDENCE.jsoninside the archive (ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/LOCKED_DIGEST.txtinside the archive (ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/PINS.jsoninside the archive (ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/REPRO_VERIFICATION.jsoninside the archive (ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.tar.gz)—
docs/provenance/SOURCE_TREE_HASH.jsoninside the archive (ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.tar.gz)—
MANIFEST.jsonbeside the archive (prodasset /data/production/docker/29.9.3-CE-ubuntu24.04-r2/), as staged for publishing—
PUBLISH_MANIFEST.jsonbeside the archive (prodasset /data/production/docker/29.9.3-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.rebuild.jsonbeside the archive (prodasset /data/production/docker/29.9.3-CE-ubuntu24.04-r2/), as staged for publishing—
ReadyStack-docker-29.9.3-CE-ubuntu24.04-r2.rebuild.json.sigstorebeside the archive (prodasset /data/production/docker/29.9.3-CE-ubuntu24.04-r2/), as staged for publishing—
SCOUT_EVIDENCE.jsonbeside the archive (prodasset /data/production/docker/29.9.3-CE-ubuntu24.04-r2/), as staged for publishing—
clean-room rebuild ledgerthe clean-room rebuild ledger (runstate/audit-2026-09/bit4bit.json, not published)—
build_requestssadb, ReadyStack's engine database (not published)558
chainssadb, ReadyStack's engine database (not published)916
defectssadb, ReadyStack's engine database (not published)docker 29.9.3-CE-ubuntu24.04-r2
drive_runssadb, ReadyStack's engine database (not published)chain 916
held_roundssadb, ReadyStack's engine database (not published)chain 916
lesson_recallssadb, ReadyStack's engine database (not published)chain 916
micro_step_runssadb, ReadyStack's engine database (not published)chain 916
release_imagessadb, ReadyStack's engine database (not published)docker 29.9.3-CE-ubuntu24.04-r2
stage_eventssadb, ReadyStack's engine database (not published)chain 916
stage_runssadb, ReadyStack's engine database (not published)chain 916
attestations.jsonthe chain's workspace on the controller (not published)—
deliverables/provenance/PROMOTION_RECORD.jsonthe chain's workspace on the controller (not published)—
g8_result.jsonthe chain's workspace on the controller (not published)—