Hardened Swedish-tutor app - Docker supply-chain security demo. DHI base, signed, attested with SBOM
1.0K
A conversational Swedish tutor (FastAPI + Anthropic Claude) built as a portfolio demo of the full Docker supply-chain stack. The app is the vehicle — the interesting part is everything attached to the image: build-time SBOM, SLSA v0.2 provenance, and a cosign keyless signature recorded in Sigstore's Rekor transparency log.
Demo image, not production. Live at lenie.selfhost.eu/docker_demo (invite). Source + full write-up: github.com/LennartOnGit/hardad.
| Layer | Detail |
|---|---|
| Base | dhi.io/python:3.13 — Docker Hardened Image, distroless, runs as nonroot |
| App | FastAPI + Anthropic Claude Swedish tutor |
| SBOM | SPDX 2.3, built by BuildKit, attached as in-toto attestation |
| Provenance | SLSA v0.2, mode=max — full build graph incl. base digest |
| Signature | cosign keyless under GitHub OIDC, logged in Rekor |
| Platforms | linux/amd64, linux/arm64 |
Same app, same Python closure, only the base changed:
| Metric | python:3.13-slim | dhi.io/python:3.13 | Δ |
|---|---|---|---|
| Image size | 89 MB | 44 MB | −51% |
| Total packages | 167 | 91 | −46% |
| Debian packages | 122 | 43 | −65% |
| Total CVEs | 23 | 16 | −30% |
The hardened scan additionally surfaces 1 Critical + 1 High against CPython 3.13.13 that don't map to the baseline's unindexed Python binaries. DHI's 7-day patch SLA gives those a contractual resolution window.
| Tag | Meaning |
|---|---|
hardened | Rolling — latest main build |
hardened-<git-sha> | Immutable per-commit |
cosign verify \
--certificate-identity-regexp 'https://github\.com/LennartOnGit/hardad/\.github/workflows/docker-ci\.yml@.*' \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
lennartondocker/hardad:hardened
docker buildx imagetools inspect lennartondocker/hardad:hardened --format '{{ json .SBOM }}'
docker buildx imagetools inspect lennartondocker/hardad:hardened --format '{{ json .Provenance }}'
This image is part of a larger stack (Postgres, secrets, reverse proxy) — it won't do anything useful alone. See the GitHub repo for the Helm chart and local-dev instructions.
Inspection only:
docker pull lennartondocker/hardad:hardened
docker scout cves lennartondocker/hardad:hardened
docker scout sbom --format spdx lennartondocker/hardad:hardened
Apache 2.0.
Content type
Image
Digest
sha256:422ed4524…
Size
254 Bytes
Last updated
3 months ago
docker pull lennartondocker/hardad:sha256-82841841812bfee8985f45dc21eff3da6ed557d8704f5756ff5d99e000b1c806.sig