Build queue

What we are building next, and every package we have shipped with its grade at release and its latest grade, each with its date and the reasons.

Queue updated hu Oct 29 2026 UTC

In the queue

What our build system is doing now: what is building, what is built and in review before it publishes, what is next in line, and what is planned. A product already on sale is listed while its next release is built: a new version, or a rebuild when a fix lands in a package it carries. Paid customer requests follow at the end. It updates this list every few minutes.

	Apache Solr10.1.0-CE-ubuntu24.04-r1New product	Built, documents in review
	Argo CDv3.5.6-CE-ubuntu24.04-r1New version, replaces v3.5.5-CE-ubuntu24.04-r1Argo CD is now v3.5.6, upstream's latest release (the release this supersedes (v3.5.5-CE-ubuntu24.04-r1) packaged v3.5.5), built on the refreshed ubuntu:24.04 base image (sha256:24737cef17f4…; v3.5.5-CE-ubuntu24.04-r1 was built on sha256:68ee22004a91…). argocd and the bundled helm v4.2.4, kustomize v5.8.2, git-lfs…	Built, documents in review
	Home Assistant2026.10.4-CE-ubuntu24.04-r1New version, replaces 2026.10.2-CE-ubuntu24.04-r1Upgrade: this release is Home Assistant Core 2026.10.4 with home-assistant-frontend 20260930.5, upstream's latest release; the release this supersedes (2026.10.2-CE-ubuntu24.04-r1) was 2026.10.2 with home-assistant-frontend 20260930.4.	Built, documents in review
	OpenBaov2.7.2-CE-ubuntu24.04-r2Rebuild, replaces v2.7.2-CE-ubuntu24.04-r1OpenBao v2.7.2 is unchanged from the release this supersedes (v2.7.2-CE-ubuntu24.04-r1); this release rebuilds it. Changes: github.com/go-jose/go-jose/v4 v4.1.4 -> v4.1.6, which fixes GHSA-mgcc-cww5-fp2q / CVE-2026-116587 (high, published 2026-10-27: a denial of service when parsing JWKs that contain RSA keys).	Built, documents in review
	Portainer2.45.3-CE-ubuntu24.04-r2Rebuild, replaces 2.45.3-CE-ubuntu24.04-r1Portainer 2.45.3 is unchanged from the release this supersedes (2.45.3-CE-ubuntu24.04-r1); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Built, documents in review
	Qdrantv1.20.0-CE-ubuntu24.04-r1New version, replaces v1.19.2-CE-ubuntu24.04-r1Qdrant v1.20.0, upstream's latest release; the release this supersedes (v1.19.2-CE-ubuntu24.04-r1) ran v1.19.2. It is built on the current ubuntu:24.04 image (sha256:24737cef17f4…), which its maintainers updated after v1.19.2-CE-ubuntu24.04-r1 was built on sha256:68ee22004a91….	Built, documents in review
	SeaweedFS4.51-CE-ubuntu24.04-r1New version, replaces 4.48-CE-ubuntu24.04-r3SeaweedFS 4.51 is upstream's latest release; the release this supersedes (4.48-CE-ubuntu24.04-r3) packaged 4.48, so this release takes in upstream's 4.49, 4.50 and 4.51.	Built, documents in review
	Traefikv3.7.16-CE-ubuntu24.04-r1New version, replaces v3.7.15-CE-ubuntu24.04-r1Traefik v3.7.16 is upstream's latest release; the release this supersedes (v3.7.15-CE-ubuntu24.04-r1) packaged v3.7.15. This release is built on the refreshed ubuntu:24.04 base image (sha256:24737cef17f4…), which its maintainers updated after v3.7.15-CE-ubuntu24.04-r1 was built on sha256:68ee22004a91…, with Go 1.26.10.	Built, documents in review
	Valkey9.1.3-CE-ubuntu24.04-r1New version, replaces 9.1.2-CE-ubuntu24.04-r2Valkey is now 9.1.3, upstream's latest release (the release this supersedes (9.1.2-CE-ubuntu24.04-r2) packaged 9.1.2), built on the refreshed ubuntu:24.04 base image (sha256:24737cef17f4…; 9.1.2-CE-ubuntu24.04-r2 was built on sha256:68ee22004a91…). Security: upstream rates 9.1.3 a security release.	Built, documents in review
	VictoriaMetricsv1.155.0-CE-ubuntu24.04-r1New version, replaces v1.154.1-CE-ubuntu24.04-r1VictoriaMetrics v1.155.0, upstream's latest single-node release; the release this supersedes (v1.154.1-CE-ubuntu24.04-r1) ran v1.154.1.	Built, documents in review
	WireGuard0.0.20250522-CE-ubuntu24.04-r1New product	Built, documents in review
1	ZITADELv4.20.0-CE-ubuntu24.04-r1New version, replaces v4.19.5-CE-ubuntu24.04-r1ZITADEL v4.20.0, upstream's latest release; the release this supersedes (v4.19.5-CE-ubuntu24.04-r1) ran v4.19.5.	In line
2	Mastodonv4.7.3-CE-ubuntu24.04-r1New product	In line
	Apache CouchDB3.5.3-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Apache Kafka4.4.0-CE-ubuntu24.04-r3Rebuild, replaces 4.4.0-CE-ubuntu24.04-r2Apache Kafka 4.4.0 is unchanged from the release this supersedes (4.4.0-CE-ubuntu24.04-r2); this release rebuilds it. Changes: the runtime user is now uid 1000, the upstream image's (apache/kafka:4.4.0), so a volume that image wrote is used as it is; 4.4.0-CE-ubuntu24.04-r2 ran as uid 999.	Planned, not scheduled yet
	Bazarrv1.6.2-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Caddyv2.11.7-CE-ubuntu24.04-r5Rebuild, replaces v2.11.7-CE-ubuntu24.04-r4Caddy v2.11.7 is unchanged from the release this supersedes (v2.11.7-CE-ubuntu24.04-r4); this release rebuilds it. Changes: github.com/go-jose/go-jose/v4 v4.1.5 -> v4.1.6, which fixes GHSA-mgcc-cww5-fp2q / CVE-2026-116587 (high, published 2026-10-27: a denial of service when parsing JWKs that contain RSA keys).	Planned, not scheduled yet
	Canvas LMS2026-05-20.143-CE-ubuntu24.04-r2Rebuild, replaces 2026-05-20.143-CE-ubuntu24.04-r1Canvas LMS 2026-05-20.143 is unchanged from the release this supersedes (2026-05-20.143-CE-ubuntu24.04-r1); this release rebuilds it.	Planned, not scheduled yet
	Consulv1.16.4-CE-ubuntu24.04-r5Rebuild, replaces v1.16.4-CE-ubuntu24.04-r4Consul v1.16.4 is unchanged from the release this supersedes (v1.16.4-CE-ubuntu24.04-r4); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet
	Drupal11.4.11-CE-ubuntu24.04-r3Rebuild, replaces 11.4.11-CE-ubuntu24.04-r2Drupal 11.4.11 is unchanged from the release this supersedes (11.4.11-CE-ubuntu24.04-r2); this release rebuilds it. Settings, ports and data volumes are those of 11.4.11-CE-ubuntu24.04-r2: replace the container with this image on the same volumes.	Planned, not scheduled yet
	etcdv3.7.3-CE-ubuntu24.04-r2Rebuild, replaces v3.7.3-CE-ubuntu24.04-r1etcd v3.7.3 is unchanged from the release this supersedes (v3.7.3-CE-ubuntu24.04-r1); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet
	Frappe CRMv1.89.1-CE-ubuntu24.04-r1New version, replaces v1.89.0-CE-ubuntu24.04-r1Upgrade: this release packages Frappe CRM v1.89.1, upstream's latest release, on the Frappe framework v16.53.0; the release it supersedes, v1.89.0-CE-ubuntu24.04-r1, packaged v1.89.0 on v16.53.0.	Planned, not scheduled yet
	Grafanav13.3.0-CE-ubuntu24.04-r1New version, replaces v13.2.4-CE-ubuntu24.04-r2Grafana is now v13.3.0, upstream's latest release (the release this supersedes (v13.2.4-CE-ubuntu24.04-r2) packaged v13.2.4); upstream's notes for it are at https://github.com/grafana/grafana/releases/tag/v13.3.0.	Planned, not scheduled yet
	Harborv2.15.4-CE-ubuntu24.04-r4Rebuild, replaces v2.15.4-CE-ubuntu24.04-r3Harbor v2.15.4 is unchanged from the release this supersedes (v2.15.4-CE-ubuntu24.04-r3); this release rebuilds it. Changes: github.com/go-jose/go-jose/v4 v4.1.4 -> v4.1.6, which fixes GHSA-mgcc-cww5-fp2q / CVE-2026-116587 (high, published 2026-10-27: a denial of service when parsing JWKs that contain RSA keys).	Planned, not scheduled yet
	InfluxDBv3.12.1-CE-ubuntu24.04-r3Rebuild, replaces v3.12.1-CE-ubuntu24.04-r2InfluxDB v3.12.1 is unchanged from the release this supersedes (v3.12.1-CE-ubuntu24.04-r2); this release rebuilds it. Changes: the runtime user is now uid 1500, the upstream image's (influxdb:3.12.1-core), so a volume that image wrote is used as it is; v3.12.1-CE-ubuntu24.04-r2 ran as uid 999.	Planned, not scheduled yet
	Keycloak26.8.1-CE-ubuntu24.04-r2Rebuild, replaces 26.8.1-CE-ubuntu24.04-r1Keycloak 26.8.1 is unchanged from the release this supersedes (26.8.1-CE-ubuntu24.04-r1); this release rebuilds it. Changes: the image is rebuilt on the current eclipse-temurin:21-jre-noble image (sha256:cd35bb338596…), which its maintainers updated after 26.8.1-CE-ubuntu24.04-r1 was built on sha256:35501d3f9317….	Planned, not scheduled yet
	Kubernetesv1.37.1-CE-ubuntu24.04-r3Rebuild, replaces v1.37.1-CE-ubuntu24.04-r2Kubernetes v1.37.1 is unchanged from the release this supersedes (v1.37.1-CE-ubuntu24.04-r2); this release rebuilds it. Changes: github.com/go-jose/go-jose/v4 v4.1.5 -> v4.1.6, which fixes GHSA-mgcc-cww5-fp2q / CVE-2026-116587 (high, published 2026-10-27: a denial of service when parsing JWKs that contain RSA keys).	Planned, not scheduled yet
	Kubernetes VM Stackv1.36.6-kubevirt1.9.1-CE-scratch-r1New product	Planned, not scheduled yet
	Lokiv3.7.9-CE-ubuntu24.04-r4Rebuild, replaces v3.7.9-CE-ubuntu24.04-r3Loki v3.7.9 is unchanged from the release this supersedes (v3.7.9-CE-ubuntu24.04-r3); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet
	Mautic7.2.2-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Mimir3.2.3-CE-ubuntu24.04-r3Rebuild, replaces 3.2.3-CE-ubuntu24.04-r2Mimir 3.2.3 is unchanged from the release this supersedes (3.2.3-CE-ubuntu24.04-r2); this release rebuilds it. Changes: github.com/go-jose/go-jose/v4 v4.1.4 -> v4.1.6, which fixes GHSA-mgcc-cww5-fp2q / CVE-2026-116587 (high, published 2026-10-27: a denial of service when parsing JWKs that contain RSA keys).	Planned, not scheduled yet
	NZBHydrav9.1.1-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	OpenProjectv17.9.4-CE-ubuntu24.04-r1New version, replaces v17.9.2-CE-ubuntu24.04-r1OpenProject v17.9.4, upstream's latest release; the release this supersedes (v17.9.2-CE-ubuntu24.04-r1) ran v17.9.2.	Planned, not scheduled yet
	OpenTelemetry Collectorv0.164.0-CE-ubuntu24.04-r2Rebuild, replaces v0.164.0-CE-ubuntu24.04-r1OpenTelemetry Collector v0.164.0 (core distribution) is unchanged from the release this supersedes (v0.164.0-CE-ubuntu24.04-r1); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet
	Percona9.7.2-2-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	PostHogmaster-20261022-b904ac8-CE-ubuntu24.04-r2Rebuild, replaces master-20261022-b904ac8-CE-ubuntu24.04-r1PostHog master-20261022-b904ac8 is unchanged from the release this supersedes (master-20261022-b904ac8-CE-ubuntu24.04-r1); this release rebuilds it.	Planned, not scheduled yet
	Prometheusv3.15.1-CE-ubuntu24.04-r3Rebuild, replaces v3.15.1-CE-ubuntu24.04-r2Prometheus v3.15.1 is unchanged from the release this supersedes (v3.15.1-CE-ubuntu24.04-r2); this release rebuilds it.	Planned, not scheduled yet
	Python3.15.2-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Radarrv6.4.4.10685-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	SWAG5.8.0-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	Syncthingv2.1.7-CE-ubuntu24.04-r3Rebuild, replaces v2.1.7-CE-ubuntu24.04-r2Syncthing v2.1.7 is unchanged from the release this supersedes (v2.1.7-CE-ubuntu24.04-r2); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet
	Tempov3.1.1-CE-ubuntu24.04-r3Rebuild, replaces v3.1.1-CE-ubuntu24.04-r2Tempo v3.1.1 is unchanged from the release this supersedes (v3.1.1-CE-ubuntu24.04-r2); this release rebuilds it. Changes: github.com/go-jose/go-jose/v4 v4.1.4 -> v4.1.6, which fixes GHSA-mgcc-cww5-fp2q / CVE-2026-116587 (high, published 2026-10-27: a denial of service when parsing JWKs that contain RSA keys).	Planned, not scheduled yet
	Transmission4.1.4-CE-ubuntu24.04-r1New product	Planned, not scheduled yet
	virt-exportproxyv1.9.1-CE-debian12-r1New product	Planned, not scheduled yet
	virt-launcherv1.9.1-CE-centos9-r1New product	Planned, not scheduled yet
	virtctlv1.9.1-CE-scratch-r1New product	Planned, not scheduled yet
	Wiki.js3.0.0-beta.685-CE-ubuntu24.04-r4Rebuild, replaces 3.0.0-beta.685-CE-ubuntu24.04-r3Wiki.js 3.0.0-beta.685 is unchanged from the release this supersedes (3.0.0-beta.685-CE-ubuntu24.04-r3); this release rebuilds it. Changes: the runtime user is now uid 1000, the upstream image's (ghcr.io/requarks/wiki:3.0.0-beta.685); 3.0.0-beta.685-CE-ubuntu24.04-r3 ran as uid 999.	Planned, not scheduled yet
	Woodpeckerv3.19.0-CE-ubuntu24.04-r3Rebuild, replaces v3.19.0-CE-ubuntu24.04-r2Woodpecker v3.19.0 is unchanged from the release this supersedes (v3.19.0-CE-ubuntu24.04-r2); this release rebuilds it on a slim base. Changes: the image no longer starts from the full ubuntu:24.04 image.	Planned, not scheduled yet

Request a package

$250 when it ships

$250 charged only when the build ships. Your card is saved now, not charged.

We build open-source Community Editions only. Every request gets a licence and feasibility check first; if we cannot take it on, we remove your card and you are never charged.

What do you need built?

A single packageOne application or service: one image and its Hermetic Build Kit. A platform stackA matched set of host programs and container images, installed together across several machines, such as a Kubernetes cluster that runs VMs. What a platform stack is

What we consider: the same tests we use to pick products ourselves

Open source at the release we would build. An OSI-approved licence; never a source-available one (Business Source, Server Side Public, Elastic, Sustainable Use, Functional Source, Commons Clause), and no Enterprise code in the build.
A server you run. An application or service, not a language runtime, a base image, a command-line tool, a plugin, agent or exporter for another product, or an add-on that only runs inside Kubernetes.
Alive and growing. Recent commits and releases and a growing following. We read ce.rodeo's Pulse, a composite of GitHub commits, stars and Hacker News activity, and the project's own release history. (ce.rodeo is run by ReadyStack, as its about page says; Pulse measures the upstream project, not any publisher of it.)
Buildable to our standard. From upstream's source, or its official release artifacts, on Ubuntu 24.04 for linux/amd64; rebuilds with the network off; runs as a non-root user where the software allows; reaches grade A on our scan and on Docker Scout.
Not mainly for downloading other people's media. We don't package torrent or Usenet clients and indexers.
Within the machine caps below. Up to 64 GB of memory, 16 vCPU and 400 GB of disk.

Loading…

Completed

Every package on sale now, newest push first, with the first and latest of our daily scans of the published image (syft + grype, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26; ce.rodeo now uses cerodeo-v2), each with how it was scored. Published images do not change, but new vulnerabilities are reported every day, so a later scan can score lower; a new release replaces the package when it ships.

Package	Pushed to Docker Hub	Original grade	Current grade	Docker Hub pulls
CoreDNSv1.14.2-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (65532:65532) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 9 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (65532:65532) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
flannelv0.28.10-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (flannel) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 66 How it was scored High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (flannel) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
flannel CNI pluginv1.9.1-flannel3-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored +10 Runs as a non-root user (flannelcniplugin) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 17 How it was scored +10 Runs as a non-root user (flannelcniplugin) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
kube-apiserverv1.36.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 65 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
kube-controller-managerv1.36.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 65 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
kube-proxyv1.36.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 65 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
kube-schedulerv1.36.6-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 65 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (999:999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
kube-vipv1.3.1-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored +10 Runs as a non-root user (kubevip) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 8 How it was scored +10 Runs as a non-root user (kubevip) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Kubernetes Nodev1.36.6-CE-scratch-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 8 × −3 = −24 +10 Runs as a non-root user (65534:65534) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached 100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 1 · H 8 · M 12 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 8 × −3 = −24 +10 Runs as a non-root user (65534:65534) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached 100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Multus CNIv4.3.1-CE-ubuntu24.04-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored +10 Runs as a non-root user (multuscni) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 8 How it was scored +10 Runs as a non-root user (multuscni) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
pause3.10.2-CE-scratch-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 5 × −3 = −15 +10 Runs as a non-root user (65535:65535) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +23 = 123, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 1 · H 5 · M 9 How it was scored Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 5 × −3 = −15 +10 Runs as a non-root user (65535:65535) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +23 = 123, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
virt-apiv1.9.1-CE-debian12-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +23 = 123, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 1 · H 3 · M 11 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +23 = 123, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
virt-controllerv1.9.1-CE-debian12-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +29 = 129, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 1 · H 3 · M 9 How it was scored Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +29 = 129, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
virt-operatorv1.9.1-CE-debian12-r1	2026-10-29	A · 100 scanned 2026-10-29 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +26 = 126, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 1 · H 3 · M 10 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (1001) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +26 = 126, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Apache Airflow3.3.2-CE-ubuntu24.04-r5	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 8 × −3 = −24 +10 Runs as a non-root user (airflow) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 88 How it was scored Medium vulnerabilities with a fix: 8 × −3 = −24 +10 Runs as a non-root user (airflow) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Apache Superset6.1.0-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (superset) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 86 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (superset) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
authentik2026.8.5-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (1000) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 137 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (1000) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
changedetection.io0.60.10-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (changedetection) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 108 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (changedetection) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
cloudflared2026.10.5-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (cloudflared) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (cloudflared) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Coderv2.38.3-CE-ubuntu24.04-r2	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (coder) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 86 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (coder) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
CrowdSecv1.8.1-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (crowdsec) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 2 · M 76 How it was scored High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (crowdsec) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Discoursev2026.9.1-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (discourse) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +32 = 132, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 1 · H 1 · M 1332 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 Critical vulnerabilities with no fix yet: 1 × −8 = −8 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (discourse) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +32 = 132, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Distribution Registryv3.1.2-CE-ubuntu24.04-r5	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (registry) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (registry) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Docker29.9.2-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (rootless) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 70 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (rootless) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
DocuSeal3.3.3-CE-alpine-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (docuseal) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 4 How it was scored +10 Runs as a non-root user (docuseal) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Fluent Bitv5.1.5-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (fluentbit) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 68 How it was scored +10 Runs as a non-root user (fluentbit) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Jenkins2.580.1-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 +10 Runs as a non-root user (jenkins) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 97 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 +10 Runs as a non-root user (jenkins) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Lokiv3.7.9-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (loki) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (loki) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Mattermostv12.0.1-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (mattermost) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 112 How it was scored +10 Runs as a non-root user (mattermost) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Miniflux2.3.4-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (miniflux) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 8 How it was scored +10 Runs as a non-root user (miniflux) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
MinIORELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (minio) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 79 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (minio) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
NATSv2.15.2-CE-ubuntu24.04-r2	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (nats) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 19 How it was scored +10 Runs as a non-root user (nats) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Nextcloudv35.0.2-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 135 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
NodeBBv4.16.4-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 5 × −3 = −15 +10 Runs as a non-root user (nodebb) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 85 How it was scored Medium vulnerabilities with a fix: 9 × −3 = −27 +10 Runs as a non-root user (nodebb) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +22 = 122, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
OpenSearch3.9.0-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (opensearch) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 134 How it was scored +10 Runs as a non-root user (opensearch) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
OpenTelemetry Collectorv0.164.0-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (otelcol) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (otelcol) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Paperless-ngxv3.3.4-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (paperless) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 1897 How it was scored Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (paperless) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +25 = 125, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Perl5.44.0-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (perl) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 64 How it was scored +10 Runs as a non-root user (perl) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
PostgreSQL18.6-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (postgres) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 70 How it was scored +10 Runs as a non-root user (postgres) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Rancherv2.15.2-CE-ubuntu24.04-r3	2026-10-28	A · 100 scanned 2026-10-28 How it was scored High vulnerabilities with no fix yet: 5 × −3 = −15 +10 Runs as a non-root user (rancher) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 5 · M 96 How it was scored High vulnerabilities with no fix yet: 5 × −3 = −15 +10 Runs as a non-root user (rancher) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +34 = 134, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Temporalv1.32.1-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (temporal) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (temporal) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Uptime Kuma2.5.8-CE-ubuntu24.04-r1	2026-10-28	A · 100 scanned 2026-10-28 How it was scored Medium vulnerabilities with a fix: 7 × −3 = −21 +10 Runs as a non-root user (uptimekuma) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 86 How it was scored Medium vulnerabilities with a fix: 10 × −3 = −30 +10 Runs as a non-root user (uptimekuma) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +19 = 119, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Vaultwarden1.37.4-CE-ubuntu24.04-r4	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (vaultwarden) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (vaultwarden) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Zabbix7.4.16-CE-ubuntu24.04-r2	2026-10-28	A · 100 scanned 2026-10-28 How it was scored +10 Runs as a non-root user (zabbix) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 100 How it was scored +10 Runs as a non-root user (zabbix) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Apache Kafka4.4.0-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (kafka) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 2 · M 75 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (kafka) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +26 = 126, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
BookStackv26.09.2-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (bookstack) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 133 How it was scored +10 Runs as a non-root user (bookstack) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Caddyv2.11.7-CE-ubuntu24.04-r4	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (caddy) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 2 · M 77 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 1 × −3 = −3 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (caddy) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Consulv1.16.4-CE-ubuntu24.04-r4	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (consul) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 78 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (consul) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Drupal11.4.11-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 134 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
ERPNextv16.52.1-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (frappe) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 753 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (frappe) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
etcdv3.7.3-CE-ubuntu24.04-r1	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (etcd) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (etcd) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Ghostv6.72.0-CE-ubuntu24.04-r4	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 9 × −3 = −27 High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (node) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 2 · M 87 How it was scored Medium vulnerabilities with a fix: 10 × −3 = −30 High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (node) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +10 = 110, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Giteav28.2.0-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (gitea) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +0 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 86 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (gitea) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +0 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Grafanav13.2.4-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (grafana) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 76 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 +10 Runs as a non-root user (grafana) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +39 = 139, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
HAProxy3.4.6-CE-ubuntu24.04-r4	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (haproxy) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 83 How it was scored +10 Runs as a non-root user (haproxy) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Harborv2.15.4-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 High vulnerabilities with no fix yet: 6 × −3 = −18 +10 Runs as a non-root user (harbor) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +19 = 119, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 7 · M 203 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 4 × −3 = −12 High vulnerabilities with no fix yet: 6 × −3 = −18 +10 Runs as a non-root user (harbor) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +9 = 109, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
InfluxDBv3.12.1-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (influxdb3) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 146 How it was scored +10 Runs as a non-root user (influxdb3) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Jitsi Meetstable-11248-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (jitsi) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (jitsi) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Kubernetesv1.37.1-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 185 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 +10 Runs as a non-root user (999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +39 = 139, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
MariaDB12.3.3-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (mysql) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 64 How it was scored +10 Runs as a non-root user (mysql) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Metabasev0.64.3.5-CE-ubuntu24.04-r1	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (metabase) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 86 How it was scored +10 Runs as a non-root user (metabase) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Mimir3.2.3-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 +10 Runs as a non-root user (mimir) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-26T06:38:44Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 2 · M 80 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 4 × −3 = −12 +10 Runs as a non-root user (mimir) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +17 = 117, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Moodlev5.3.0-CE-ubuntu24.04-r4	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 134 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
MySQL9.7.4-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (mysql) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 64 How it was scored +10 Runs as a non-root user (mysql) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
NetBoxv4.7.3-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (netbox) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 191 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (netbox) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +28 = 128, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
NGINX1.31.8-CE-ubuntu24.04-r1	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (nginx) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (nginx) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
OpenBaov2.7.2-CE-ubuntu24.04-r1	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (openbao) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 2 · M 76 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (openbao) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +36 = 136, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Portainer2.45.3-CE-ubuntu24.04-r1	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 5 × −3 = −15 Critical vulnerabilities with no fix yet: 2 × −8 = −16 High vulnerabilities with no fix yet: 4 × −3 = −12 +10 Runs as a non-root user (portainer) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 2 · H 4 · M 85 How it was scored Medium vulnerabilities with a fix: 5 × −3 = −15 Critical vulnerabilities with no fix yet: 2 × −8 = −16 High vulnerabilities with no fix yet: 4 × −3 = −12 +10 Runs as a non-root user (portainer) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +6 = 106, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Prometheusv3.15.1-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (prometheus) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (prometheus) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
RabbitMQ4.4.0-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (rabbitmq) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (rabbitmq) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Redashv26.9.0-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 11 × −3 = −33 +10 Runs as a non-root user (redash) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 91 How it was scored Medium vulnerabilities with a fix: 11 × −3 = −33 +10 Runs as a non-root user (redash) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +13 = 113, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Redis8.10.2-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (redis) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 64 How it was scored +10 Runs as a non-root user (redis) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Syncthingv2.1.7-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (syncthing) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (syncthing) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Tempov3.1.1-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (tempo) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 2 · M 76 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 +10 Runs as a non-root user (tempo) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +29 = 129, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Wiki.js3.0.0-beta.685-CE-ubuntu24.04-r3	2026-10-27	A · 100 scanned 2026-10-27 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (wiki) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 91 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (wiki) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Woodpeckerv3.19.0-CE-ubuntu24.04-r2	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (woodpecker) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 76 How it was scored +10 Runs as a non-root user (woodpecker) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
WordPress7.1.3-CE-ubuntu24.04-r4	2026-10-27	A · 100 scanned 2026-10-27 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-27T06:30:41Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 135 How it was scored +10 Runs as a non-root user (www-data) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Frappe CRMv1.89.0-CE-ubuntu24.04-r1	2026-10-24	A · 100 scanned 2026-10-24 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (frappe) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-23T06:30:15Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 762 How it was scored Medium vulnerabilities with a fix: 11 × −3 = −33 High vulnerabilities with no fix yet: 1 × −3 = −3 +10 Runs as a non-root user (frappe) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +10 = 110, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
PostHogmaster-20261022-b904ac8-CE-ubuntu24.04-r1	2026-10-24	A · 100 scanned 2026-10-24 How it was scored Medium vulnerabilities with a fix: 12 × −3 = −36 High vulnerabilities with no fix yet: 2 × −3 = −6 +10 Runs as a non-root user (posthog) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +4 = 104, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-24T17:45:29Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	C · 58 scanned 2026-10-29C 0 · H 7 · M 95 How it was scored High vulnerabilities with a fix: 4 × −10 = −40 Medium vulnerabilities with a fix: 13 × −3 = −39 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (posthog) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −42 = 58. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Canvas LMS2026-05-20.143-CE-ubuntu24.04-r1	2026-10-22	A · 100 scanned 2026-10-22 How it was scored +10 Runs as a non-root user (canvas) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-22T18:51:21Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 84 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (canvas) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Home Assistant2026.10.2-CE-ubuntu24.04-r1	2026-10-22	A · 100 scanned 2026-10-22 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (homeassistant) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-22T06:29:52Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 1084 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (homeassistant) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +31 = 131, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
VictoriaMetricsv1.154.1-CE-ubuntu24.04-r1	2026-10-22	A · 100 scanned 2026-10-22 How it was scored +10 Runs as a non-root user (victoriametrics) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-22T06:29:52Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 78 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (victoriametrics) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Argo CDv3.5.5-CE-ubuntu24.04-r1	2026-10-21	A · 100 scanned 2026-10-22 How it was scored Medium vulnerabilities with a fix: 6 × −3 = −18 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +0 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +19 = 119, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-21T06:31:02Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 93 scanned 2026-10-29C 0 · H 5 · M 231 How it was scored High vulnerabilities with a fix: 2 × −10 = −20 Medium vulnerabilities with a fix: 8 × −3 = −24 High vulnerabilities with no fix yet: 3 × −3 = −9 +10 Runs as a non-root user (999) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +0 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 −7 = 93. A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
OpenProjectv17.9.2-CE-ubuntu24.04-r1	2026-10-21	A · 100 scanned 2026-10-21 How it was scored +10 Runs as a non-root user (app) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-20T06:29:49Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 1313 How it was scored Medium vulnerabilities with a fix: 4 × −3 = −12 +10 Runs as a non-root user (app) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +37 = 137, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
SeaweedFS4.48-CE-ubuntu24.04-r3	2026-10-21	A · 100 scanned 2026-10-22 How it was scored +10 Runs as a non-root user (seaweedfs) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-21T06:31:02Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 78 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (seaweedfs) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Valkey9.1.2-CE-ubuntu24.04-r2	2026-10-21	A · 100 scanned 2026-10-22 How it was scored +10 Runs as a non-root user (valkey) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-21T06:31:02Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 65 How it was scored Medium vulnerabilities with a fix: 1 × −3 = −3 +10 Runs as a non-root user (valkey) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Keycloak26.8.1-CE-ubuntu24.04-r1	2026-10-20	A · 100 scanned 2026-10-21 How it was scored +10 Runs as a non-root user (keycloak) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-20T06:29:49Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 89 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (keycloak) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +33 = 133, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Qdrantv1.19.2-CE-ubuntu24.04-r1	2026-10-20	A · 100 scanned 2026-10-21 How it was scored +10 Runs as a non-root user (qdrant) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +49 = 149, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-20T06:29:49Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 0 · M 78 How it was scored Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (qdrant) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
Traefikv3.7.15-CE-ubuntu24.04-r1	2026-10-20	A · 100 scanned 2026-10-21 How it was scored +10 Runs as a non-root user (traefik) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +0 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +46 = 146, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-20T06:29:49Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 78 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 2 × −3 = −6 +10 Runs as a non-root user (traefik) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +0 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +30 = 130, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit
ZITADELv4.19.5-CE-ubuntu24.04-r1	2026-10-20	A · 100 scanned 2026-10-21 How it was scored Medium vulnerabilities with a fix: 3 × −3 = −9 +10 Runs as a non-root user (zitadel) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +40 = 140, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-20T06:29:49Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	A · 100 scanned 2026-10-29C 0 · H 1 · M 83 How it was scored High vulnerabilities with a fix: 1 × −10 = −10 Medium vulnerabilities with a fix: 6 × −3 = −18 +10 Runs as a non-root user (zitadel) +10 Pushed in the last 90 days +5 Signed (cosign) +5 SLSA build provenance attached +5 Provenance names this exact image +3 HEALTHCHECK defined +3 Standard OCI labels (4 or more) +0 Built for several architectures +3 Matches an upstream GitHub release +3 SBOM attached +2 Docker Hub README shows how to run it 100 +21 = 121, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40. Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-28T06:23:30Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).	Not available	Docker Hub Get build kit