Skip to main content
Menu

Introducing Rasid hardened container images

Published · Fahad

Rasid ships hardened container image binaries under the Apache 2.0 licence at images.rasid.cc. They are free to pull, free to redistribute, and ready to drop into production.

This is the launch post. Here is what we are, what we ship, and what we promise.

What we ship

A small but growing catalogue of hardened replacements for the most-pulled OCI base images — Postgres, Redis, nginx, Node, Python, Go, Caddy, BusyBox, scratch, curl, with more landing each week.

Every image in the catalogue is:

  • Zero known CVEs at release. We scan against the union of NVD, OSV, Wolfi advisories, and the upstream project’s own security feed. If a known CVE makes it past the scan, the release is blocked.
  • Daily rebuild. Every image is rebuilt every 24 hours against the latest advisory data, even when no recipe changed. Patch latency is the product.
  • Cosign-signed. Every published digest is signed against Rasid’s self-hosted Sigstore chain at fulcio.rasid.cc + rekor.rasid.cc. Verification key published at https://rasid.cc/.well-known/rasid-cosign.pub.
  • SBOM included. Both CycloneDX 1.5 and SPDX 2.3 manifests for every tag. No mystery layers.
  • in-toto attested. SLSA Level 3 build provenance bound to every image. You can prove what produced it.

Drop one into a Dockerfile, verify the signature in your CI, and you’re running on a hardened base. No account required. No rate limit on the open catalogue.

What you can do with the images

Per Apache 2.0 § 4: pull them, run them, repackage them, redistribute them under your own brand if you need to. The licence requires you to preserve the NOTICE attribution in any redistribution. That is the whole obligation.

We will not introduce a “free for non-commercial use” carve-out. We will not introduce a per-pull fee or a rate-limit gate. The licence on the public catalogue does not change.

What we are, what we are not

We are a hardened-image vendor. The image binaries at images.rasid.cc are Apache 2.0, free and freely redistributable. The build pipeline that produces them is proprietary, operated by us. Customer data — sales contracts, support tickets, custom-build sources — stays on Rasid-controlled infrastructure and is not shared with third parties.

We are not an open-source project. There is no public source mirror, no community contribution channel, no public bug tracker. What you get from us, free and forever, is the binary, the SBOM, the attestation, and the signature. That is what production actually needs.

This is the same posture as professional container-image vendors: the binaries are licensed Apache 2.0 and free; the operational machinery that produces them is the vendor’s IP.

What pays for this

The public catalogue is the marketing for the enterprise tier. Enterprise variants — FIPS 140-3 cryptographic modules, air-gap delivery bundles, compliance evidence packs, private custom builds, and named-SLA support — fund the work.

What to do next

If you want to try a hardened image right now:

docker pull images.rasid.cc/postgres:17
cosign verify images.rasid.cc/postgres:17 \
  --key https://rasid.cc/.well-known/rasid-cosign.pub

If you operate a regulated workload and want to talk about FIPS, air-gap, compliance, or private custom builds, the enterprise contact path goes directly to sales.

If you find a security issue with one of our images, [email protected] — disclosure policy and PGP key fingerprint at /.well-known/security.txt.

— Fahad