Docker Engine 23 rootful¶

Upstream Docker Engine 23.0.6 static payload on maintained Alpine, rootful daemon

Image: ghcr.io/strukturpiloten/docker-23-rootful
Declared image version: v23.0.6
Family: Docker Engine
Architecture: amd64, arm64
Inner mode: rootful

Declared runtime base: docker.io/library/alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6

Image source and metadata · GHCR package · Detailed guide

Choose and inspect¶

Declared upstream software: 23.0.6

Declared tags: v23.0.6, v23.0, v23, main, latest. These are publication policy aliases, not proof that any tag exists in GHCR. Even the exact SemVer tag can move after a reviewed rebuild.

Registry status: observed; checked at 2026-09-28T10:15:26.374834+00:00.

Observed latest index digest: sha256:b368d9defa3d8f721413d27d571abc32e223cc2b2c6141b688bcc959f08e2ac9.

Pull the observed immutable artifact:

podman pull ghcr.io/strukturpiloten/docker-23-rootful@sha256:b368d9defa3d8f721413d27d571abc32e223cc2b2c6141b688bcc959f08e2ac9

For an isolated Linux nested-Docker test, the outer Podman boundary runs rootfully and privileged. Use a trusted runner and keep its image store separate from other tests:

sudo podman run --rm --detach --name nested-docker --privileged --device /dev/fuse --security-opt label=disable ghcr.io/strukturpiloten/docker-23-rootful@sha256:b368d9defa3d8f721413d27d571abc32e223cc2b2c6141b688bcc959f08e2ac9
ready=0
for attempt in $(seq 1 30); do
  if sudo podman exec nested-docker docker info >/dev/null 2>&1; then ready=1; break; fi
  sleep 2
done
if [ "$ready" -eq 1 ]; then sudo podman exec nested-docker docker info; else sudo podman logs nested-docker; fi
sudo podman stop nested-docker
test "$ready" -eq 1

This fixture does not use the host Docker socket. Read the detailed guide for nested workloads.

Support and runtime contract¶

Lifecycle: legacy; admission: isolated-test; review after: 2026-10-27.

Pinned static Engine and bundled dependencies are not patched by Alpine OS rebuilds; isolated compatibility fixture only.

Declared runtime profiles: docker. Declared test settings are in the metadata source. Admission is policy, not evidence of a passed test.

Declared runtime test contract:

{
  "docker": {
    "mode": "rootful",
    "nestedRuntime": true,
    "outerPrivilege": "privileged"
  }
}

Registry aliases and history¶

Aliases resolved to the observed current digest: latest, main, v23, v23.0, v23.0.6.

Listed without digest resolution: run-36338188065-1-sha-237848af5481e58c6b0fec3ee0944d644eb59867, run-36346260768-1-sha-0b136a13a8bb612d91960ae5d07e72f449c89ec1, sha-0b136a13a8bb612d91960ae5d07e72f449c89ec1, sha-237848af5481e58c6b0fec3ee0944d644eb59867, sha256-2a68baeafb1d10b9ab93f48ba4f329d2f4bfd9533b16e3fd04b9695ed3fc11bc, sha256-2c425c2ff17373bbad75cd0a7840c1c552c4efc434d4af67cec5f359267cf410, sha256-2edb5aeac2cefebbb0ff607fa0063e81569b0b2a30f59c53e309fe6c4358ee26, sha256-7c53098252521fdfdf3b6d6cd095813acd37f851979fed810fc72ad52885b2e4, sha256-b368d9defa3d8f721413d27d571abc32e223cc2b2c6141b688bcc959f08e2ac9, sha256-c50d57ad266ff191686b3c92992f9df5ecde7fe130fc3188080f3d22d6a0ab9c.

Evidence and timestamps¶

Matching release asset verified the build record and per-architecture runtime and scan evidence. Signature and provenance remain unverified in this snapshot.

Maintenance release · Evidence asset

GitHub package activity can include signatures and attestations; it does not identify when the current runnable image was published. A registry observation is a point-in-time check; mutable tags may move afterward. Use the immutable digest and maintenance evidence for an audit.