Portainer 2.45.3

Ubuntu 24.04 · DevOps & CI/CD · Built from upstream's source

Free image

Docker Hub
docker pull readystack/portainer:2.45.3-CE-ubuntu24.04-r1
# check it is ours before you run it
cosign verify --key https://readystack.dev/keys/cosign.pub \
  readystack/portainer:2.45.3-CE-ubuntu24.04-r1
This release on Docker Hub

Hermetic Build Kit

$10, one-time

The build kit for this exact release: its pinned base images, source, packages and toolchain, not a copy of the published image. Rebuild, verify and operate it offline, with handbooks checked against the image, seed data, the security report and the defect record.

Buy build kit · $10 SLSA provenance on your own builder

Grade

ReadyStack's own scan, daily
Original grade
A · 100
pushed and scanned 2026-10-27
How it was scored
  • Medium vulnerabilities with a fix: 5 × −3 = −15
  • Critical vulnerabilities with no fix yet: 2 × −8 = −16
  • High vulnerabilities with no fix yet: 4 × −3 = −12
  • +10 Runs as a non-root user (portainer)
  • +10 Pushed in the last 90 days
  • +5 Signed (cosign)
  • +5 SLSA build provenance attached
  • +5 Provenance names this exact image
  • +3 HEALTHCHECK defined
  • +3 Standard OCI labels (4 or more)
  • +0 Built for several architectures
  • +3 Matches an upstream GitHub release
  • +3 SBOM attached
  • +2 Docker Hub README shows how to run it

100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40.

Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).

Current grade
A · 100
scanned 2026-10-27C 2 · H 4 · M 86
How it was scored
  • Medium vulnerabilities with a fix: 5 × −3 = −15
  • Critical vulnerabilities with no fix yet: 2 × −8 = −16
  • High vulnerabilities with no fix yet: 4 × −3 = −12
  • +10 Runs as a non-root user (portainer)
  • +10 Pushed in the last 90 days
  • +5 Signed (cosign)
  • +5 SLSA build provenance attached
  • +5 Provenance names this exact image
  • +3 HEALTHCHECK defined
  • +3 Standard OCI labels (4 or more)
  • +0 Built for several architectures
  • +3 Matches an upstream GitHub release
  • +3 SBOM attached
  • +2 Docker Hub README shows how to run it

100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40.

Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).

A syft SBOM and grype vulnerability matches, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26. The original grade is the first recorded scan of this release, the current grade the latest. All products

This release

As JSON
  • Release tag2.45.3-CE-ubuntu24.04-r1
  • Pushed to Docker Hub2026-10-27
  • linux/amd64 digestsha256:a2cbe2d511c57174efe65263c59e63f50b081168921f328977e8665e8b3c9e34
  • Offline rebuildRebuilt bit-for-bit on 2026-10-27 with the network off
  • SignatureSigned (key 04daa92344a52dbc)
  • Runs asNon-root (portainer)
  • AttestationsSBOM (SPDX) and SLSA provenance v1
  • Start command addsdocker.sock (optional)
    To manage the Docker engine on its own host, Portainer mounts the host's Docker socket (and joins the socket's group), which gives control of that engine and so of the host. Portainer itself runs as the unprivileged user portainer. The non-root rule
  • Defects1 found in review, fixed before release
    1 open in this release