3 Prevalent Themes in the Discussion
| Theme | Supporting Quote(s) |
|---|---|
| 1️⃣ A free, near‑zero‑CVE image library – users highlight the appeal of having thousands of hardened images without cost or friction. | “These are all >1200 of our images, including FIPS, and all versions… others gate many of their images” – morellonet “Our Community Edition are all the exact same images as the Enterprise Edition product customers around the world already use, just without… no auth wall, no signup, no trial, no limit on numbers of images or pulls” – morellonet |
| 2️⃣ Security & trust concerns – readers want proof that the images are safe, reproducible, and properly signed or documented. | “We build every component directly from source in a SLSA 3 environment… providing a cryptographically verifiable SBOM for every build… signing every image” – morellonet “How do you prove that what I download from you is actually what you promise you've build (and that SBOM is right)? Is this certified with some digital signature?” – alfanick |
| 3️⃣ Preference over other hardened‑image providers (DHI, Chainguard, etc.) – users compare feature sets, pricing, and the advantage of building from source on a distroless base. | “Why would I use this over DHI (Docker Hardened Images) or Chainguard Images, both of which also have a set of free hardened images?” – hobofan (raised as a key question) “These are all built continuously from upstream source on a distroless base… this makes a significant difference in attack surface and CVE count re DHI images” – morellonet “Free markets work :)” – morellonet |
Quick Take
- The discussion centers on free availability of a large, up‑to‑date image catalog.
- Security transparency (SBOMs, signatures, reproducible builds) is repeatedly demanded.
- Competitive advantage over other hardened‑image services is emphasized through continuous source‑based builds and broader image coverage.
These three themes capture the core of the community’s feedback.