Build queue

What we are building next, and every package we have shipped with its grade at release and its latest grade, each with its date and the reasons.

Queue updated Sat Nov 07 2026 UTC

In the queue

What our build system is doing now: what is building, what is built and in review before it publishes, what is next in line, and what is planned. A product already published is listed while its next release is built: a new version, or a rebuild when a fix lands in a package it carries. Customer requests follow at the end. It updates this list every few minutes.

	Apache Kafka4.4.0-CE-ubuntu24.04-r3Rebuild, replaces 4.4.0-CE-ubuntu24.04-r2Apache Kafka 4.4.0 is unchanged from the release this supersedes (4.4.0-CE-ubuntu24.04-r2); this release rebuilds it. Changes: the runtime user is now uid 1000, the upstream image's (apache/kafka:4.4.0), so a volume that image wrote is used as it is; 4.4.0-CE-ubuntu24.04-r2 ran as uid 999.	Built, documents in review
	Apache Solr10.1.0-CE-ubuntu24.04-r1New product	Built, documents in review
	Consulv1.16.4-CE-ubuntu24.04-r6Rebuild, replaces v1.16.4-CE-ubuntu24.04-r5Consul v1.16.4 is unchanged from the release this supersedes (v1.16.4-CE-ubuntu24.04-r5); this release rebuilds it. Changes: golang.org/x/net moves from v0.60.0 to 0.62.0 (GO-2026-6860, GO-2026-6866).	Built, documents in review
	etcdv3.7.3-CE-ubuntu24.04-r2Rebuild, replaces v3.7.3-CE-ubuntu24.04-r1etcd v3.7.3 is unchanged from the release this supersedes (v3.7.3-CE-ubuntu24.04-r1); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Built, documents in review
	Python3.15.2-CE-ubuntu24.04-r1New product	Built, documents in review
	Apache CouchDB3.5.3-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Bazarrv1.6.2-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	CrowdSecv1.8.2-CE-ubuntu24.04-r1New version, replaces v1.8.1-CE-ubuntu24.04-r4	Planned, not scheduled yet
	DocuSeal3.3.5-CE-alpine-r1New version, replaces 3.3.3-CE-alpine-r3DocuSeal 3.3.5, upstream's latest release (2026-11-02); the release this supersedes (3.3.3-CE-alpine-r3) ran 3.3.3. 3.3.4 and 3.3.5 are upstream's weekly releases: the Rails gems move from 8.1.3.1 to 8.1.4, json from 2.21.2 to 3.1.0, net-imap to 0.6.8, wordcraft (the DOCX-to-PDF library) from 0.8.0 to 0.11.0, and the…	Planned, not scheduled yet
	Harborv2.15.4-CE-ubuntu24.04-r5Rebuild, replaces v2.15.4-CE-ubuntu24.04-r4Harbor v2.15.4 is unchanged from the release this supersedes (v2.15.4-CE-ubuntu24.04-r4); this release rebuilds it.	Planned, not scheduled yet
	InfluxDBv3.12.1-CE-ubuntu24.04-r3Rebuild, replaces v3.12.1-CE-ubuntu24.04-r2InfluxDB v3.12.1 is unchanged from the release this supersedes (v3.12.1-CE-ubuntu24.04-r2); this release rebuilds it. Changes: the runtime user is now uid 1500, the upstream image's (influxdb:3.12.1-core), so a volume that image wrote is used as it is; v3.12.1-CE-ubuntu24.04-r2 ran as uid 999.	Planned, not scheduled yet
	Jitsi Meetstable-11248-CE-ubuntu24.04-r3Rebuild, replaces stable-11248-CE-ubuntu24.04-r2Jitsi Meet stable-11248 is unchanged from the release this supersedes (stable-11248-CE-ubuntu24.04-r2); this release rebuilds it. Changes: apt moves from 2.8.3 to 2.8.4ubuntu0.1 (CVE-2026-109518); libapt-pkg6.0t64 moves from 2.8.3 to 2.8.4ubuntu0.1 (CVE-2026-109518).	Planned, not scheduled yet
	Kubernetesv1.37.2-CE-ubuntu24.04-r1New version, replaces v1.37.1-CE-ubuntu24.04-r2Kubernetes v1.37.2, upstream's latest 1.37 release (2026-10-28); the release this supersedes (v1.37.1-CE-ubuntu24.04-r2) ran v1.37.1. v1.37.1 to v1.37.2 changes no Go module (go.mod is identical), no kubeadm default image version and no pause version; upstream's changes are in its own code and in its build files (the…	Planned, not scheduled yet
	Mautic7.2.2-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Metabasev0.65.2.6-CE-ubuntu24.04-r1New version, replaces v0.64.3.5-CE-ubuntu24.04-r1Metabase v0.65.2.6, upstream's latest open-source release, the 0.65 line (0.65.2 was released 2026-10-30; v0.65.2.6 is its sixth hotfix); the release this supersedes (v0.64.3.5-CE-ubuntu24.04-r1) ran v0.64.3.5. Upstream's release notes list the changes at https://www.metabase.com/changelog/65.	Planned, not scheduled yet
	Miniflux2.3.5-CE-ubuntu24.04-r1New version, replaces 2.3.4-CE-ubuntu24.04-r3	Planned, not scheduled yet
	Nextcloudv35.0.2-CE-ubuntu24.04-r5Rebuild, replaces v35.0.2-CE-ubuntu24.04-r4Nextcloud v35.0.2 is unchanged from the release this supersedes (v35.0.2-CE-ubuntu24.04-r4); this release rebuilds it. Changes: apt moves from 2.8.3 to 2.8.4ubuntu0.1 (CVE-2026-109518); libapt-pkg6.0t64 moves from 2.8.3 to 2.8.4ubuntu0.1 (CVE-2026-109518).	Planned, not scheduled yet
	NZBHydrav9.2.0-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	OpenTelemetry Collectorv0.164.0-CE-ubuntu24.04-r2Rebuild, replaces v0.164.0-CE-ubuntu24.04-r1OpenTelemetry Collector v0.164.0 (core distribution) is unchanged from the release this supersedes (v0.164.0-CE-ubuntu24.04-r1); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet
	Percona9.7.2-2-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Perl5.44.0-CE-ubuntu24.04-r2Rebuild, replaces 5.44.0-CE-ubuntu24.04-r1Perl 5.44.0 is unchanged from the release this supersedes (5.44.0-CE-ubuntu24.04-r1); this release rebuilds it. Changes: apt moves from 2.8.3 to 2.8.4ubuntu0.1 (CVE-2026-109518); libapt-pkg6.0t64 moves from 2.8.3 to 2.8.4ubuntu0.1 (CVE-2026-109518).	Planned, not scheduled yet
	Portainer2.45.3-CE-ubuntu24.04-r2Rebuild, replaces 2.45.3-CE-ubuntu24.04-r1Portainer 2.45.3 is unchanged from the release this supersedes (2.45.3-CE-ubuntu24.04-r1); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet
	Radarrv6.4.4.10685-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	SWAG5.9.0-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Syncthingv2.1.7-CE-ubuntu24.04-r3Rebuild, replaces v2.1.7-CE-ubuntu24.04-r2Syncthing v2.1.7 is unchanged from the release this supersedes (v2.1.7-CE-ubuntu24.04-r2); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet
	Transmission4.1.4-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Uptime Kuma2.5.9-CE-ubuntu24.04-r1New version, replaces 2.5.8-CE-ubuntu24.04-r3	Planned, not scheduled yet
	Wiki.js3.0.0-beta.685-CE-ubuntu24.04-r4Rebuild, replaces 3.0.0-beta.685-CE-ubuntu24.04-r3Wiki.js 3.0.0-beta.685 is unchanged from the release this supersedes (3.0.0-beta.685-CE-ubuntu24.04-r3); this release rebuilds it. Changes: the runtime user is now uid 1000, the upstream image's (ghcr.io/requarks/wiki:3.0.0-beta.685); 3.0.0-beta.685-CE-ubuntu24.04-r3 ran as uid 999.	Planned, not scheduled yet
	Woodpeckerv3.19.0-CE-ubuntu24.04-r3Rebuild, replaces v3.19.0-CE-ubuntu24.04-r2Woodpecker v3.19.0 is unchanged from the release this supersedes (v3.19.0-CE-ubuntu24.04-r2); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet

Request a package

Free

Ask on our public issue tracker, or email [email protected], with what you need built. ReadyStack does not charge for requests.

We build open-source Community Editions only. Every request gets a licence and feasibility check first, and we reply either way. When it ships, its image is free on Docker Hub and its Hermetic Build Kit is free to download with an account.

What do you need built?

A single packageOne application or service: one image and its Hermetic Build Kit. A platform stackA matched set of host programs and container images, installed together across several machines, such as a Kubernetes cluster that runs VMs. What a platform stack is

What we consider: the same tests we use to pick products ourselves

Open source at the release we would build. An OSI-approved licence; never a source-available one (Business Source, Server Side Public, Elastic, Sustainable Use, Functional Source, Commons Clause), and no Enterprise code in the build.
A server you run. An application or service, not a language runtime, a base image, a command-line tool, a plugin, agent or exporter for another product, or an add-on that only runs inside Kubernetes.
Alive and growing. Recent commits and releases and a growing following. We read ce.rodeo's Pulse, a composite of GitHub commits, stars and Hacker News activity, and the project's own release history. (ce.rodeo is run by ReadyStack, as its about page says; Pulse measures the upstream project, not any publisher of it.)
Buildable to our standard. From upstream's source, or its official release artifacts, on Ubuntu 24.04 for linux/amd64; rebuilds with the network off; runs as a non-root user where the software allows; reaches grade A on our scan and on Docker Scout.
Not mainly for downloading other people's media. We don't package torrent or Usenet clients and indexers.
Within the machine caps below. Up to 64 GB of memory, 16 vCPU and 400 GB of disk.

Request a package Email us instead

Say the project's name, a link to its source, the Ubuntu release (22.04, 24.04 or 26.04) and the memory, CPUs and disk it needs.

Completed

Every package published now, newest push first, with the first and latest of our daily scans of the published image (syft + grype, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26; ce.rodeo now uses cerodeo-v2), each with how it was scored. Published images do not change, but new vulnerabilities are reported every day, so a later scan can score lower; a new release replaces the package when it ships.

Package	Pushed to Docker Hub	Original grade	Current grade	Docker Hub pulls
BookStackv26.09.2-CE-ubuntu24.04-r4	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (bookstack) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 145 How it was scored +10 Runs as a non-root user (bookstack) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Caddyv2.11.9-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (caddy) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 1 · M 73 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (caddy) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
cloudflared2026.10.7-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (cloudflared) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 71 How it was scored +10 Runs as a non-root user (cloudflared) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
CoreDNSv1.14.2-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (65532:65532) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 11 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (65532:65532) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Distribution Registryv3.1.2-CE-ubuntu24.04-r6	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (registry) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 73 How it was scored +10 Runs as a non-root user (registry) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Docker29.9.3-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (rootless) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 68 How it was scored +10 Runs as a non-root user (rootless) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
flannelv0.28.10-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (flannel) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 1 · M 64 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (flannel) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Fluent Bitv5.1.5-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (fluentbit) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 65 How it was scored +10 Runs as a non-root user (fluentbit) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Grafanav13.3.0-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (grafana) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 71 How it was scored +10 Runs as a non-root user (grafana) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
HAProxy3.4.6-CE-ubuntu24.04-r5	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (haproxy) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 73 How it was scored +10 Runs as a non-root user (haproxy) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Jenkins2.580.2-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 +10 Runs as a non-root user (jenkins) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 120 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 +10 Runs as a non-root user (jenkins) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
kube-vipv1.3.1-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (kubevip) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 9 How it was scored +10 Runs as a non-root user (kubevip) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Kubernetes Nodev1.36.6-CE-scratch-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 9 × −3 = −27 +10 Runs as a non-root user (65534:65534) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached 100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 1 · H 9 · M 15 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 9 × −3 = −27 +10 Runs as a non-root user (65534:65534) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached 100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Lokiv3.7.9-CE-ubuntu24.04-r4	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (loki) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 13 How it was scored +10 Runs as a non-root user (loki) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
MinIORELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r8	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (minio) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 76 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (minio) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Moodlev5.3.0-CE-ubuntu24.04-r5	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 144 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
NetBoxv4.7.4-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (netbox) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 226 How it was scored Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (netbox) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
NodeBBv4.16.7-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 5 × −3 = −15 +10 Runs as a non-root user (nodebb) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 76 How it was scored Medium vulnerabilities with a fix: 5 × −3 = −15 +10 Runs as a non-root user (nodebb) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
OpenBaov2.7.2-CE-ubuntu24.04-r3	2026-11-07	A · 100 scanned 2026-11-07 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (openbao) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 1 · M 75 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (openbao) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
OpenProjectv17.9.6-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (app) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 1339 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (app) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Qdrantv1.20.0-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (qdrant) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 71 How it was scored +10 Runs as a non-root user (qdrant) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Redashv26.9.0-CE-ubuntu24.04-r5	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 11 × −3 = −33 +10 Runs as a non-root user (redash) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 101 How it was scored Medium vulnerabilities with a fix: 11 × −3 = −33 +10 Runs as a non-root user (redash) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Tempov3.1.1-CE-ubuntu24.04-r4	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (tempo) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 73 How it was scored +10 Runs as a non-root user (tempo) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Temporalv1.32.2-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (temporal) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 93 How it was scored +10 Runs as a non-root user (temporal) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Traefikv3.7.17-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (traefik) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 72 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (traefik) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Vaultwarden1.37.5-CE-ubuntu24.04-r1	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (vaultwarden) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 71 How it was scored +10 Runs as a non-root user (vaultwarden) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
VictoriaMetricsv1.155.0-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored +10 Runs as a non-root user (victoriametrics) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 73 How it was scored +10 Runs as a non-root user (victoriametrics) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
WireGuard0.0.20250522-CE-ubuntu24.04-r2	2026-11-07	A · 100 scanned 2026-11-07 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (wireguard) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 1 · M 62 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (wireguard) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-07T06:18:48Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Keycloak26.8.2-CE-ubuntu24.04-r1	2026-11-06	A · 100 scanned 2026-11-06 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (keycloak) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 112 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (keycloak) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Prometheusv3.16.0-CE-ubuntu24.04-r1	2026-11-06	A · 100 scanned 2026-11-06 How it was scored +10 Runs as a non-root user (nobody) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 73 How it was scored +10 Runs as a non-root user (nobody) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
RabbitMQ4.4.0-CE-ubuntu24.04-r3	2026-11-06	A · 100 scanned 2026-11-06 How it was scored +10 Runs as a non-root user (rabbitmq) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 73 How it was scored +10 Runs as a non-root user (rabbitmq) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Valkey9.1.3-CE-ubuntu24.04-r2	2026-11-06	A · 100 scanned 2026-11-06 How it was scored +10 Runs as a non-root user (valkey) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 61 How it was scored +10 Runs as a non-root user (valkey) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
MariaDB12.3.3-CE-ubuntu24.04-r4	2026-11-05	A · 100 scanned 2026-11-05 How it was scored +10 Runs as a non-root user (mysql) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-04T06:20:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 61 How it was scored +10 Runs as a non-root user (mysql) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
MySQL9.7.4-CE-ubuntu24.04-r3	2026-11-05	A · 100 scanned 2026-11-05 How it was scored +10 Runs as a non-root user (mysql) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 61 How it was scored +10 Runs as a non-root user (mysql) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
NGINX1.31.8-CE-ubuntu24.04-r2	2026-11-05	A · 100 scanned 2026-11-05 How it was scored +10 Runs as a non-root user (nginx) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-04T06:20:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 73 How it was scored +10 Runs as a non-root user (nginx) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
PostgreSQL18.6-CE-ubuntu24.04-r5	2026-11-05	A · 100 scanned 2026-11-05 How it was scored +10 Runs as a non-root user (postgres) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-04T06:20:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 69 How it was scored +10 Runs as a non-root user (postgres) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
SeaweedFS4.52-CE-ubuntu24.04-r1	2026-11-05	A · 100 scanned 2026-11-05 How it was scored +10 Runs as a non-root user (seaweedfs) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 73 How it was scored +10 Runs as a non-root user (seaweedfs) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
WordPress7.1.4-CE-ubuntu24.04-r1	2026-11-05	A · 100 scanned 2026-11-05 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-05T06:21:06Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 147 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Consulv1.16.4-CE-ubuntu24.04-r5	2026-11-03	A · 100 scanned 2026-11-03 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (consul) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-03T06:20:47Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 1 · M 13 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (consul) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Mimir3.2.3-CE-ubuntu24.04-r3	2026-11-02	A · 100 scanned 2026-11-02 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 +10 Runs as a non-root user (mimir) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	D · 50 scanned 2026-11-07C 0 · H 6 · M 86 How it was scored High vulnerabilities with a fix: 6 × −10 = −60 Medium vulnerabilities with a fix: 13 × −3 = −39 +10 Runs as a non-root user (mimir) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −50 = 50. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
PostHogmaster-20261022-b904ac8-CE-ubuntu24.04-r3	2026-11-02	A · 100 scanned 2026-11-02 How it was scored Medium vulnerabilities with a fix: 9 × −3 = −27 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (posthog) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +16 = 116, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	F · 29 scanned 2026-11-07C 0 · H 7 · M 114 How it was scored High vulnerabilities with a fix: 6 × −10 = −60 Medium vulnerabilities with a fix: 18 × −3 = −54 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (posthog) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −71 = 29. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
authentik2026.8.5-CE-ubuntu24.04-r4	2026-11-01	A · 100 scanned 2026-11-01 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (1000) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-31T06:18:17Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	B · 73 scanned 2026-11-07C 0 · H 4 · M 157 How it was scored High vulnerabilities with a fix: 4 × −10 = −40 Medium vulnerabilities with a fix: 11 × −3 = −33 +10 Runs as a non-root user (1000) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −27 = 73. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
ERPNextv16.53.0-CE-ubuntu24.04-r1	2026-11-01	A · 100 scanned 2026-11-01 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (frappe) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 96 scanned 2026-11-07C 0 · H 3 · M 802 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 9 × −3 = −27 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (frappe) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −4 = 96. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Frappe CRMv1.90.0-CE-ubuntu24.04-r2	2026-11-01	A · 100 scanned 2026-11-01 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (frappe) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 96 scanned 2026-11-07C 0 · H 3 · M 802 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 9 × −3 = −27 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (frappe) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −4 = 96. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Mastodonv4.7.4-CE-ubuntu24.04-r1	2026-11-01	A · 100 scanned 2026-11-01 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (mastodon) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 96 scanned 2026-11-07C 0 · H 3 · M 112 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 10 × −3 = −30 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (mastodon) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −4 = 96. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Paperless-ngxv3.4.1-CE-ubuntu24.04-r1	2026-11-01	A · 100 scanned 2026-11-01 How it was scored Medium vulnerabilities with a fix: 5 × −3 = −15 +10 Runs as a non-root user (paperless) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-01T06:20:12Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 87 scanned 2026-11-07C 0 · H 2 · M 812 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 13 × −3 = −39 +10 Runs as a non-root user (paperless) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −13 = 87. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Uptime Kuma2.5.8-CE-ubuntu24.04-r3	2026-10-31	A · 100 scanned 2026-10-31 How it was scored Medium vulnerabilities with a fix: 10 × −3 = −30 +10 Runs as a non-root user (uptimekuma) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +19 = 119, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-30T06:23:28Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	B · 72 scanned 2026-11-07C 0 · H 2 · M 92 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 19 × −3 = −57 +10 Runs as a non-root user (uptimekuma) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −28 = 72. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Canvas LMS2026-05-20.143-CE-ubuntu24.04-r2	2026-10-30	A · 100 scanned 2026-10-30 How it was scored +10 Runs as a non-root user (canvas) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	B · 83 scanned 2026-11-07C 1 · H 2 · M 97 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (canvas) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −17 = 83. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Argo CDv3.5.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +22 = 122, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	F · 9 scanned 2026-11-07C 0 · H 11 · M 284 How it was scored High vulnerabilities with a fix: 8 × −10 = −80 Medium vulnerabilities with a fix: 17 × −3 = −51 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −91 = 9. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
flannel CNI pluginv1.9.1-flannel3-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored +10 Runs as a non-root user (flannelcniplugin) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 19 How it was scored Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (flannelcniplugin) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Ghostv6.72.0-CE-ubuntu24.04-r5	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 10 × −3 = −30 High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (node) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +10 = 110, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	D · 47 scanned 2026-11-07C 0 · H 5 · M 95 How it was scored High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 21 × −3 = −63 High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (node) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −53 = 47. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Harborv2.15.4-CE-ubuntu24.04-r4	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 High vulnerabilities with no fix yet: 6 × −3 = −18 +10 Runs as a non-root user (harbor) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +19 = 119, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	F · 6 scanned 2026-11-07C 0 · H 14 · M 253 How it was scored High vulnerabilities with a fix: 8 × −10 = −80 Medium vulnerabilities with a fix: 15 × −3 = −45 High vulnerabilities with no fix yet: 6 × −3 = −18 +10 Runs as a non-root user (harbor) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −94 = 6. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Home Assistant2026.10.4-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 5 × −3 = −15 +10 Runs as a non-root user (homeassistant) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	C · 68 scanned 2026-11-07C 1 · H 2 · M 1171 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 12 × −3 = −36 +10 Runs as a non-root user (homeassistant) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −32 = 68. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
kube-apiserverv1.36.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 89 scanned 2026-11-07C 0 · H 3 · M 70 How it was scored High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 9 × −3 = −27 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −11 = 89. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
kube-controller-managerv1.36.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 89 scanned 2026-11-07C 0 · H 3 · M 70 How it was scored High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 9 × −3 = −27 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −11 = 89. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
kube-proxyv1.36.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 89 scanned 2026-11-07C 0 · H 3 · M 70 How it was scored High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 9 × −3 = −27 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −11 = 89. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
kube-schedulerv1.36.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 89 scanned 2026-11-07C 0 · H 3 · M 70 How it was scored High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 9 × −3 = −27 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −11 = 89. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Kubernetes VM Stackv1.36.6-kubevirt1.9.1-CE-scratch-r2	2026-10-29	A · 100 scanned 2026-10-29 How it was scored +10 Runs as a non-root user (65534:65534) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 0 How it was scored +10 Runs as a non-root user (65534:65534) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Multus CNIv4.3.1-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored +10 Runs as a non-root user (multuscni) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	C · 55 scanned 2026-11-07C 0 · H 7 · M 17 How it was scored High vulnerabilities with a fix: 7 × −10 = −70 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (multuscni) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −45 = 55. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
pause3.10.2-CE-scratch-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 5 × −3 = −15 +10 Runs as a non-root user (65535:65535) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +23 = 123, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 1 · H 6 · M 12 How it was scored Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 6 × −3 = −18 +10 Runs as a non-root user (65535:65535) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +20 = 120, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
virt-apiv1.9.1-CE-debian12-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +23 = 123, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 1 · H 5 · M 12 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 3 × −3 = −9 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 4 × −3 = −12 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +7 = 107, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
virt-controllerv1.9.1-CE-debian12-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +29 = 129, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 1 · H 5 · M 10 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 4 × −3 = −12 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
virt-exportproxyv1.9.1-CE-debian12-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +29 = 129, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 1 · H 5 · M 10 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 4 × −3 = −12 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
virt-operatorv1.9.1-CE-debian12-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +26 = 126, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 1 · H 5 · M 11 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 2 × −3 = −6 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 4 × −3 = −12 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +10 = 110, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
virtctlv1.9.1-CE-scratch-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored +10 Runs as a non-root user (65532) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 1 · M 1 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (65532) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
ZITADELv4.20.0-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (zitadel) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	B · 79 scanned 2026-11-07C 0 · H 4 · M 84 How it was scored High vulnerabilities with a fix: 4 × −10 = −40 Medium vulnerabilities with a fix: 10 × −3 = −30 +10 Runs as a non-root user (zitadel) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −21 = 79. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Apache Airflow3.3.2-CE-ubuntu24.04-r5	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 8 × −3 = −24 +10 Runs as a non-root user (airflow) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	C · 56 scanned 2026-11-07C 1 · H 2 · M 119 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 16 × −3 = −48 +10 Runs as a non-root user (airflow) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −44 = 56. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Apache Superset6.1.0-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (superset) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	F · 16 scanned 2026-11-07C 1 · H 6 · M 108 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 6 × −10 = −60 Medium vulnerabilities with a fix: 16 × −3 = −48 +10 Runs as a non-root user (superset) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −84 = 16. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
changedetection.io0.60.10-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (changedetection) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	D · 52 scanned 2026-11-07C 1 · H 3 · M 131 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 14 × −3 = −42 +10 Runs as a non-root user (changedetection) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −48 = 52. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Coderv2.38.3-CE-ubuntu24.04-r2	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (coder) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	B · 82 scanned 2026-11-07C 0 · H 4 · M 100 How it was scored High vulnerabilities with a fix: 4 × −10 = −40 Medium vulnerabilities with a fix: 9 × −3 = −27 +10 Runs as a non-root user (coder) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −18 = 82. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
CrowdSecv1.8.1-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (crowdsec) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	C · 56 scanned 2026-11-07C 0 · H 8 · M 82 How it was scored High vulnerabilities with a fix: 6 × −10 = −60 Medium vulnerabilities with a fix: 9 × −3 = −27 High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (crowdsec) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −44 = 56. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Discoursev2026.9.1-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (discourse) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +32 = 132, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	D · 50 scanned 2026-11-07C 2 · H 4 · M 1369 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 11 × −3 = −33 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (discourse) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −50 = 50. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
DocuSeal3.3.3-CE-alpine-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (docuseal) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	B · 73 scanned 2026-11-07C 2 · H 4 · M 5 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 4 × −10 = −40 Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 +10 Runs as a non-root user (docuseal) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −27 = 73. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Mattermostv12.0.1-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (mattermost) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	F · 12 scanned 2026-11-07C 2 · H 6 · M 134 How it was scored Critical vulnerabilities with a fix: 2 × −25 = −50 High vulnerabilities with a fix: 6 × −10 = −60 Medium vulnerabilities with a fix: 9 × −3 = −27 +10 Runs as a non-root user (mattermost) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −88 = 12. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Miniflux2.3.4-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (miniflux) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 1 · H 1 · M 11 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (miniflux) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +11 = 111, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
NATSv2.15.2-CE-ubuntu24.04-r2	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (nats) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 0 · M 21 How it was scored Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (nats) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Nextcloudv35.0.2-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 154 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +8 = 108, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
OpenSearch3.9.0-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (opensearch) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 149 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (opensearch) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +8 = 108, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
OpenTelemetry Collectorv0.164.0-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (otelcol) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 95 scanned 2026-11-07C 0 · H 3 · M 81 How it was scored High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 8 × −3 = −24 +10 Runs as a non-root user (otelcol) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −5 = 95. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Perl5.44.0-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (perl) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 68 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (perl) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +5 = 105, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Rancherv2.15.2-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored High vulnerabilities with no fix yet: 5 × −3 = −15 +10 Runs as a non-root user (rancher) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	F · 0 scanned 2026-11-07C 0 · H 23 · M 126 How it was scored High vulnerabilities with a fix: 18 × −10 = −180 Medium vulnerabilities with a fix: 19 × −3 = −57 High vulnerabilities with no fix yet: 5 × −3 = −15 +10 Runs as a non-root user (rancher) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −203 = −103, held to 0 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Zabbix7.4.16-CE-ubuntu24.04-r2	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (zabbix) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 104 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 9 × −3 = −27 +10 Runs as a non-root user (zabbix) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +2 = 102, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Apache Kafka4.4.0-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (kafka) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 85 scanned 2026-11-07C 0 · H 4 · M 85 How it was scored High vulnerabilities with a fix: 4 × −10 = −40 Medium vulnerabilities with a fix: 8 × −3 = −24 +10 Runs as a non-root user (kafka) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −15 = 85. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Drupal11.4.11-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 164 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +8 = 108, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
etcdv3.7.3-CE-ubuntu24.04-r1	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (etcd) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	C · 69 scanned 2026-11-07C 0 · H 5 · M 83 How it was scored High vulnerabilities with a fix: 5 × −10 = −50 Medium vulnerabilities with a fix: 10 × −3 = −30 +10 Runs as a non-root user (etcd) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −31 = 69. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Giteav28.2.0-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (gitea) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +0 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	F · 31 scanned 2026-11-07C 1 · H 6 · M 132 How it was scored Critical vulnerabilities with a fix: 1 × −25 = −25 High vulnerabilities with a fix: 6 × −10 = −60 Medium vulnerabilities with a fix: 10 × −3 = −30 +10 Runs as a non-root user (gitea) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +0 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −69 = 31. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
InfluxDBv3.12.1-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (influxdb3) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 183 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (influxdb3) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +8 = 108, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Jitsi Meetstable-11248-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (jitsi) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 80 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (jitsi) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +8 = 108, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Kubernetesv1.37.1-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	F · 0 scanned 2026-11-07C 0 · H 22 · M 244 How it was scored High vulnerabilities with a fix: 22 × −10 = −220 Medium vulnerabilities with a fix: 23 × −3 = −69 +10 Runs as a non-root user (999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −240 = −140, held to 0 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Metabasev0.64.3.5-CE-ubuntu24.04-r1	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (metabase) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 96 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (metabase) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +8 = 108, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Portainer2.45.3-CE-ubuntu24.04-r1	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 5 × −3 = −15 Critical vulnerabilities with no fix yet: 2 × −8 = −16 High vulnerabilities with no fix yet: 4 × −3 = −12 +10 Runs as a non-root user (portainer) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	D · 42 scanned 2026-11-07C 2 · H 8 · M 90 How it was scored High vulnerabilities with a fix: 4 × −10 = −40 Medium vulnerabilities with a fix: 13 × −3 = −39 Critical vulnerabilities with no fix yet: 2 × −8 = −16 High vulnerabilities with no fix yet: 4 × −3 = −12 +10 Runs as a non-root user (portainer) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −58 = 42. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Redis8.10.2-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (redis) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-11-07C 0 · H 2 · M 68 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (redis) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +8 = 108, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Syncthingv2.1.7-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (syncthing) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 95 scanned 2026-11-07C 0 · H 3 · M 103 How it was scored High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 8 × −3 = −24 +10 Runs as a non-root user (syncthing) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −5 = 95. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Wiki.js3.0.0-beta.685-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (wiki) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 93 scanned 2026-11-07C 0 · H 2 · M 106 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 12 × −3 = −36 +10 Runs as a non-root user (wiki) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −7 = 93. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register
Woodpeckerv3.19.0-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (woodpecker) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 95 scanned 2026-11-07C 0 · H 3 · M 103 How it was scored High vulnerabilities with a fix: 3 × −10 = −30 Medium vulnerabilities with a fix: 8 × −3 = −24 +10 Runs as a non-root user (woodpecker) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −5 = 95. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-11-06T06:21:59Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Register