Skip to content
hello-kubernetes

Container image

View as Markdown

Where it is

Section titled “Where it is”
Registry Image
GitHub Container Registry (recommended) ghcr.io/paulbouwer/hello-kubernetes
Docker Hub paulbouwer/hello-kubernetes

Both have the same images, with the same SBOM and signed provenance. We recommend GHCR: it has no Docker Hub pull limits, and its images sit next to the source and the release that built them.

The chart uses Docker Hub by default in 1.x. To use GHCR, set deployment.container.image.repository to ghcr.io/paulbouwer/hello-kubernetes, or choose it in the config builder. In 2.0, GHCR becomes the default.

Tags

Section titled “Tags”

Each release publishes three tags:

Tag Follows Use it to
1.11.0 this release only pin an exact version
1.11 the newest 1.11.x get fixes, but no new features
1 the newest 1.x stay on the current major version

There is no latest tag. The chart installs the exact version in its appVersion, so one chart version always installs the same image.

Platforms

Section titled “Platforms”

Every tag is one image index for linux/amd64 and linux/arm64. Your node pulls its own architecture, and the page shows which one it runs, such as linux/arm64.

What’s in it

Section titled “What’s in it”
  • Node.js 24 on Alpine Linux, with only the app’s production dependencies.
  • The app runs as the numeric user 1000, with no package manager in the image. See Security defaults.
  • It listens on port 8080, set with PORT.
  • OCI labels for the version, the source and the revision it was built from.

Check an image

Section titled “Check an image”

Each published image has an SBOM and SLSA provenance for each platform. Its provenance is signed with GitHub artifact attestations, so you can check that this repo’s release workflow built it:

Terminal
digest=$(docker buildx imagetools inspect ghcr.io/paulbouwer/hello-kubernetes:1.11.0 --format "{{json .Manifest}}" | jq -r .digest)
gh attestation verify oci://ghcr.io/paulbouwer/hello-kubernetes@$digest --repo paulbouwer/hello-kubernetes

Check the image by its digest, so the tag can’t move between the two commands. You need Docker with Buildx, jq, and the GitHub CLI.

To list the packages in the SBOM of one platform:

Terminal
docker buildx imagetools inspect paulbouwer/hello-kubernetes:1.11.0 --format "{{json .SBOM}}" |
  jq -r '.["linux/amd64"].SPDX.packages[] | "\(.name) \(.versionInfo)"'

The chart is signed the same way. See With Helm.

Build your own

Section titled “Build your own”

To build the image yourself, or push it to your own registry, see Build and push container images in the repo.