Skip to content

address review feedback on DHI build update #24198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
ajeetraina wants to merge 1 commit into
base: main
Choose a base branch
from
+15 −3
Draft

address review feedback on DHI build update #24198

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 15 additions & 3 deletions content/manuals/dhi/how-to/build.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,10 +13,23 @@ metadata. The DHI build system produces a signed image containing only the requi
packages, with a Software Bill of Materials (SBOM) and SLSA Build Level 3
provenance.

This guide is for teams building private custom images and developers who want
to contribute new image definitions to the DHI catalog.

This page explains how to write a DHI definition file, build images locally, and
use advanced patterns such as build stages, third-party repositories, file
paths, and dev variants.

> [!NOTE]
>
> When you build your own hardened images using this guide, you benefit from
> SBOM generation, a declarative build approach, and security-focused tooling.
> However, self-built images don't carry the same guarantees as images pulled
> from the DHI catalog, such as Docker's continuous vulnerability remediation,
> full attestation chain, and SLSA Build Level 3 provenance from Docker's
> secure build service.


> [!IMPORTANT]
>
> You must authenticate to the Docker Hardened Images registry (`dhi.io`) to
Expand Down Expand Up @@ -785,12 +798,11 @@ Measure the security improvement against an equivalent non-hardened image:

```console
$ docker scout compare my-image:latest \
--to <non-hardened-equivalent>:<tag> \
--to <current-image>:<tag> \
--platform linux/amd64
```

Replace `<non-hardened-equivalent>` with the Docker Official Image or
community image you're comparing against.
Replace `<curent-image>` with the image you're replacing.

### Inspect with Docker Debug

Expand Down