You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -32,49 +32,41 @@ Be sure to replace the `ORGANIZATION` placeholder with the name used for your or
32
32
<!--getting:end-->
33
33
34
34
<!--body:start-->
35
+
## Compatibility Notes
36
+
Like most other Chainguard Images, the Cosign image has few-to-zero CVEs and does not run as the root user.
35
37
38
+
## Getting Started
39
+
You can use the Cosign image to sign and verify container images via Docker or through automated workflows such as GitHub Actions.
36
40
41
+
### Verifying a container image signature
42
+
To verify an image signature, use the image to run Cosign's `verify` command. As of Cosign 2.0, Cosign defaults to using Sigstore's keyless mode, you'll need to also specify the OIDC issuer and signer identity to tell Cosign who you trust for the verification process.
37
43
38
-
## Image Variants
39
-
40
-
Our `latest` tag uses the most recent build of the [Wolfi Cosign](https://github.com/wolfi-dev/os/blob/main/cosign.yaml) package. The following tagged variant is available without authentication:
41
-
42
-
-`latest`: This is an image for running `cosign` commands. It does not include a shell or other applications.
43
-
44
-
### Cosign Version
45
-
This will automatically pull the image to your local system and execute the command `cosign version`:
44
+
For convenience, you can export those values as environment variables in your shell, and then tell Docker to pass those environment variables into the running Cosign container:
cosign: A tool for Container Signing, Verification and Storage in an OCI registry.
61
-
62
-
...
63
-
Platform: linux/arm64
54
+
docker run --rm \
55
+
-e COSIGN_CERTIFICATE_OIDC_ISSUER \
56
+
-e COSIGN_CERTIFICATE_IDENTITY \
57
+
cgr.dev/chainguard/cosign \
58
+
verify cgr.dev/chainguard/cosign
64
59
```
65
60
66
-
67
-
68
-
## Usage
69
-
70
61
### Signing a container image
71
62
72
-
For example, from GitHub Actions:
63
+
The following GitHub Action will log into the registry, push an image, and then sign it with Cosign:
73
64
74
65
75
66
```yaml
76
67
on:
77
-
push:
68
+
workflow_dispatch:
69
+
78
70
env:
79
71
IMAGE: ghcr.io/${{ github.repository }}
80
72
DOCKER_CONFIG: .docker-tmp
@@ -85,7 +77,7 @@ jobs:
85
77
id-token: write
86
78
packages: write
87
79
steps:
88
-
- name: Login to registry
80
+
- name: Log in to registry
89
81
run: |
90
82
set -x
91
83
mkdir -p "${DOCKER_CONFIG}"
@@ -96,8 +88,8 @@ jobs:
96
88
- name: Push image with docker
97
89
run: |
98
90
set -x
99
-
docker pull alpine:latest
100
-
docker tag alpine:latest "${IMAGE}"
91
+
docker pull cgr.dev/chainguard/wolfi-base
92
+
docker tag cgr.dev/chainguard/wolfi-base "${IMAGE}"
101
93
docker push "${IMAGE}"
102
94
- name: Sign image with cosign
103
95
run: |
@@ -112,35 +104,103 @@ jobs:
112
104
-a sha=${{ github.sha }} \
113
105
-a run_id=${{ github.run_id }} \
114
106
-a run_attempt=${{ github.run_attempt }}
107
+
```
108
+
109
+
### Attesting to an image's SBOM
110
+
111
+
Another common use case for Cosign is attesting to an image's SBOM (software bill of materials). The following command creates an attestation of type `spdxjson` for an image based on the provided SBOM file and image digest:
112
+
113
+
```shell
114
+
docker run --rm cgr.dev/chainguard/cosign attest --type spdxjson \
A detailed guide on how to sign an SBOM with Cosign is available on [Chainguard Academy](https://edu.chainguard.dev/open-source/sigstore/cosign/how-to-sign-an-sbom-with-cosign/).
119
121
120
-
To verify an image signature, use the image to run Cosign's `verify` command. Since as of Cosign 2.0, Cosign defaults to using Sigstore's keyless mode, you'll need to also specify the OIDC issuer and signer identity to tell Cosign who you trust for the verification process.
121
122
122
-
For convenience, you can export those values as environment variables in your shell, and then tell Docker to pass those environment variables into the running Cosign container.
123
+
### Verifying an Attestation
123
124
124
-
For example, to use the Cosign image to verify the signature of the Cosign image itself:
125
+
Cosign can also be used to verify the identity of the person or entity issuing an attestation. To verify that an attestation was issued by a specific entity, we use the `cosign verify-attestation` command, specifying the email address of the issuer:
Chainguard image for [Redis](https://github.com/redis/redis), an in-memory database that persists on disk. Redis is a key-value store, supporting an array of different values, including Strings, Lists, Sets, Sorted Sets, Hashes, Streams, HyperLogLogs, and Bitmaps.
19
19
20
20
Chainguard Images are regularly-updated, minimal container images with low-to-zero CVEs.
21
21
<!--overview:end-->
@@ -32,87 +32,108 @@ Be sure to replace the `ORGANIZATION` placeholder with the name used for your or
32
32
<!--getting:end-->
33
33
34
34
<!--body:start-->
35
+
## Compatibility Notes
35
36
36
-
## Important - license update
37
+
The Chainguard Redis image is comparable to [the official Redis image on Docker Hub](https://hub.docker.com/_/redis).
37
38
38
-
Redis version 7.4 and subsequent releases are no longer licensed under
39
-
BSD-3-Clause. A dual licensing model has been adopted, of which users have the
40
-
choice to adopt either RSALv2 or SSPLv1.
39
+
Unlike many other Chainguard images, the Redis image includes a shell, allowing you to interact with the Redis database using the Redis command-line interface, `redis-cli`.
41
40
42
-
Please give careful consideration to the licensing conditions when consuming
43
-
redis. For more information, refer to the [upstream license information](https://github.com/redis/redis/blob/unstable/LICENSE.txt).
41
+
By default this image runs as a non-root user named `redis` with a uid of `65532`. Typically, Redis does not have a default data directory and instead defaults to whatever the working directory is for the Redis process. The Chainguard Redis image provides a default working directory of `/data` that is writeable by the `redis` user.
44
42
45
-
##Overview
43
+
### Important license update
46
44
47
-
Redis is an in-memory database that persists on disk.
45
+
Redis version 7.4 and subsequent releases are no longer licensed under BSD-3-Clause; instead, the Redis project has adopted a dual licensing model. This means users have the choice to adopt either the Redis Source Available License v2 (RSALv2) or the Server Side Public License v1 (SSPLv1).
48
46
49
-
The data model is key-value, but many different kind of values are supported: Strings, Lists, Sets, Sorted Sets, Hashes, Streams, HyperLogLogs, Bitmaps.
47
+
Please give careful consideration to these licensing conditions when using Redis. For more details, refer to the [upstream license information](https://github.com/redis/redis/blob/unstable/LICENSE.txt).
To run the Chainguard Redis image with Docker using default configuration you could run the following command:
55
52
56
-
Our `latest` tag use the most recent build of the [Wolfi Redis](https://github.com/wolfi-dev/os/blob/main/redis.yaml) package.
57
-
The `latest` tagged variant is a distroless image for running Redis.
53
+
```sh
54
+
docker run -p 6379:6379 --rm cgr.dev/chainguard/redis
55
+
```
58
56
59
-
## Redis Version
60
-
This will automatically pull the image to your local system and execute the command `redis --version`:
57
+
This command forwards port `6379` (the default port for Redis) on the host machine to port `6379` on the container:
61
58
62
-
```shell
63
-
docker run --rm cgr.dev/chainguard/redis --version
59
+
```
60
+
1:C 25 Oct 2024 17:12:32.419 * oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
61
+
1:C 25 Oct 2024 17:12:32.419 * Redis version=7.4.1, bits=64, commit=74b289a0, modified=1, pid=1, just started
62
+
1:C 25 Oct 2024 17:12:32.419 # Warning: no config file specified, using the default config. In order to specify a config file use /usr/bin/redis-server /path/to/redis.conf
63
+
1:M 25 Oct 2024 17:12:32.420 * monotonic clock: POSIX clock_gettime
64
+
1:M 25 Oct 2024 17:12:32.420 * Running mode=standalone, port=6379.
65
+
1:M 25 Oct 2024 17:12:32.421 * Server initialized
66
+
1:M 25 Oct 2024 17:12:32.421 * Ready to accept connections tcp
64
67
```
65
68
66
-
You should see output similar to this:
69
+
Following that, you can open another terminal and use `redis-cli` locally. Any commands you run through it will be forwarded to the `redis` process in the container:
67
70
68
71
```
69
-
Redis server v=7.0.8 sha=00000000:0 malloc=libc bits=64 build=736cb94cbb0b299
72
+
$ redis-cli set test 10
73
+
OK
74
+
$ redis-cli get test
75
+
"10"
76
+
$ redis-cli
77
+
127.0.0.1:6379>
70
78
```
71
79
72
-
## Using Redis
73
-
74
-
The default redis port is 6379.
75
-
To run with Docker using default configuration:
80
+
Alternatively, to test out Redis within the container, you can run the following command to access the container's shell:
76
81
77
82
```sh
78
-
docker run -p 6379:6379 --rm cgr.dev/chainguard/redis
79
-
1:C 27 Dec 2022 16:42:20.647 # oO0OoO0OoO0Oo Redis is starting oO0OoO0OoO0Oo
80
-
1:C 27 Dec 2022 16:42:20.647 # Redis version=7.0.7, bits=64, commit=00000000, modified=0, pid=1, just started
81
-
1:C 27 Dec 2022 16:42:20.647 # Warning: no config file specified, using the default config. In order to specify a config file use redis-server /path/to/redis.conf
82
-
1:M 27 Dec 2022 16:42:20.648 * monotonic clock: POSIX clock_gettime
83
-
1:M 27 Dec 2022 16:42:20.648 * Running mode=standalone, port=6379.
84
-
1:M 27 Dec 2022 16:42:20.648 # Server initialized
85
-
1:M 27 Dec 2022 16:42:20.650 * Ready to accept connections
83
+
docker run -it --entrypoint sh cgr.dev/chainguard/redis
84
+
```
85
+
86
+
Then run the `redis-server` command to start the `redis` process, and include the `--daemonize yes` option to prevent it from taking over the terminal:
87
+
88
+
```
89
+
/data $ redis-server --daemonize yes
90
+
```
91
+
92
+
Following that, you can run `redis-cli`, the Redis command-line interface, and begin testing the database:
93
+
94
+
```
95
+
/data $ redis-cli
96
+
127.0.0.1:6379> set test 20
97
+
OK
98
+
127.0.0.1:6379> get test
99
+
"20"
86
100
```
87
101
88
-
## Users and Directories
102
+
## Configuration
89
103
90
-
By default this image runs as a non-root user named `redis` with a uid of 65532.
91
-
Redis does not have a default data directory, it defaults to whatever the working directory is for the process.
92
-
We provide a default `WORKDIR` of `/data` that is writeable by the `redis` user.
104
+
If you supply a different configuration file or change the user, UID, or `WORKDIR` instruction, you'll need to ensure the user running the `redis` process has permissions to access the relevant `redis.conf` and `dumb.rb` files.
93
105
94
-
If you supply a different configuration file or change the user, UID, or `WORKDIR`, you'll need to ensure the user running the redis
95
-
process has permissions to write to that directory.
106
+
When running in Docker using a volume, the Chainguard Redis image will automatically use a custom configuration instead of the default one. Here's an example that mounts a host volume containing a custom Redis configuration to the `/data` directory in the container:
96
107
97
-
When running in Docker using a volume, that should also be taken care of automatically.
98
-
Here's an example of using a host volume:
108
+
```sh
109
+
docker run -d -v $(pwd):/data -p 6379:6379 cgr.dev/chainguard/redis
110
+
```
111
+
112
+
Again, this example forwards the local port `6379` to the container's port `6379`, the `redis` process's default port.
113
+
114
+
Following that, you can run `redis-cli` commands from your local machine which are then forwarded to the container:
99
115
100
116
```
101
-
% docker run -d -v $(pwd):/data -p 6379:6379 redis
* (eBook) [How To Manage a Redis Database](https://www.digitalocean.com/community/books/how-to-manage-a-redis-database-ebook)
135
+
* (Tutorial) [How to Port a Sample Application to Chainguard Images](https://edu.chainguard.dev/chainguard/migration/porting-apps-to-chainguard/) — this article works through porting a small but complete application (built on NodeJS and Redis) to use Chainguard Images
short_description: Chainguard image for [Redis](https://github.com/redis/redis), an in-memory database that persists on disk. Redis is a key-value store, supporting an array of different values, including Strings, Lists, Sets, Sorted Sets, Hashes, Streams, HyperLogLogs, and Bitmaps.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4&size=40){kind=avatar}
0 commit comments