A minimal Linux environment with Crane container image tool, providing a lightweight solution for container image manipulation, registry operations, and image management in containerized environments.
Getting Started
To pull the image:
docker pull registry.hardened.eu/library/crane:latest
Verifying Image Signatures
All Hardened B.V. images are signed using cosign. You can verify the signature using the following steps:
Save the public key:
cat >hardened.pub <<EOL
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEbxhUFlXkIIbDzdRAR9rc6kDPNb+k
J48lhqqlOMyiq3jkbKXNj2sEFMduFlNh63MrZA59PKf4TjS1AiCrvaFXNA==
-----END PUBLIC KEY-----
EOL
Verify the image signature:
cosign verify --key hardened.pub registry.hardened.eu/library/crane:latest
The verification will show the signature details and confirm the image’s authenticity.
To verify the SBOM, run the following command:
cosign verify-attestation --type spdxjson --key hardened.pub registry.hardened.eu/library/crane:latest
To download the SBOM, run the same command and decode it:
cosign verify-attestation --type spdxjson --key hardened.pub registry.hardened.eu/library/crane:latest | jq -r .payload | base64 -d | jq -r .predicate > crane-spdx.json
Trademarks
This software is packaged by Hardened B.V. All trademarks are property of their respective owners. Use of these images does not imply any affiliation or endorsement.
The latest tag is only public. Contact us for detailed information.
Hash | Tag | Size (compressed) | Last updated | Actions |
---|---|---|---|---|
sha256:8ec16a099f2ea... |
latest
x86_64
|
4.82 MB | 08:55:50 07/08/2025 UTC (Calculating...) | |
•••••••••••• | •••••••••••• | •••••••••••• | •••••••••••• | Contact Hardened |
Package | Version | License |
---|---|---|
alpine-os-release | 3.22-r2 | MIT |
busybox | 10.0.0-r0 | GPL-2.0-only |
ca-certificates-bundle | 20250619-r0 | (MPL-2.0 AND MIT) |
crane | 0.20.6-r0 | Apache-2.0 |
github.com/containerd/stargz-snapshotter/estargz | v0.16.3 | - |
github.com/docker/cli | v28.2.2+incompatible | - |
github.com/docker/distribution | v2.8.3+incompatible | - |
github.com/docker/docker-credential-helpers | v0.9.3 | - |
github.com/google/go-cmp | v0.7.0 | - |
github.com/google/go-containerregistry | v0.20.6+dirty | - |
github.com/klauspost/compress | v1.18.0 | - |
github.com/mitchellh/go-homedir | v1.1.0 | - |
github.com/opencontainers/go-digest | v1.0.0 | - |
github.com/opencontainers/image-spec | v1.1.1 | - |
github.com/pkg/errors | v0.9.1 | - |
github.com/sirupsen/logrus | v1.9.3 | - |
github.com/spf13/cobra | v1.9.1 | - |
github.com/spf13/pflag | v1.0.6 | - |
github.com/vbatts/tar-split | v0.12.1 | - |
golang.org/x/sync | v0.15.0 | - |
golang.org/x/sys | v0.33.0 | - |
stdlib | go1.24.4 | BSD-3-Clause |
The Apache License 2.0 is also a permissive license, similar to the MIT License, but with additional protections related... Show more
The BSD 3-Clause License is another permissive license originating from the Berkeley Software Distribution (BSD). It all... Show more
The GNU General Public License version 2 (GPL-2.0) is a strict copyleft license. If you modify and distribute software l... Show more
The MIT License is a highly permissive open-source license. It allows users to do almost anything with a project, includ... Show more
CVE | Severity | Package | Version | Fixed In | |
---|---|---|---|---|---|
CVE-2025-47907 | High | stdlib | go1.24.4 | 1.23.12 | |
Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error.
|
Image comparison functionality will be implemented in a future release.