Docker Engine Fedora 44 rootless¶

Native Fedora 44 moby-engine package with rootless Docker daemon for isolated compatibility tests

Image: ghcr.io/strukturpiloten/docker-fedora-44-rootless
Declared image version: v1.0.0
Family: Docker Engine
Architecture: amd64, arm64
Inner mode: rootless

Declared runtime base: registry.fedoraproject.org/fedora:44@sha256:1ccd18224d9b302fe62d3cefd0a9e0724c365ea8ac3bfb017c569540fe76433a

Image source and metadata · GHCR package · Detailed guide

Choose and inspect¶

The distribution selects the installed engine package at build time. Inspect the published image's component manifest or SBOM for its exact revision.

Declared tags: v1.0.0, v1.0, v1, main, latest. These are publication policy aliases, not proof that any tag exists in GHCR. Even the exact SemVer tag can move after a reviewed rebuild.

Registry status: observed; checked at 2026-09-28T10:16:13.755613+00:00.

Observed latest index digest: sha256:b885ad1ffe5a09fa4006dae30e37f077b9505050f1155597b6ce04b5d9807a59.

Pull the observed immutable artifact:

podman pull ghcr.io/strukturpiloten/docker-fedora-44-rootless@sha256:b885ad1ffe5a09fa4006dae30e37f077b9505050f1155597b6ce04b5d9807a59

For an isolated Linux nested-Docker test, the outer Podman boundary runs rootfully and privileged. Use a trusted runner and keep its image store separate from other tests:

sudo podman run --rm --detach --name nested-docker --privileged --device /dev/fuse --security-opt label=disable ghcr.io/strukturpiloten/docker-fedora-44-rootless@sha256:b885ad1ffe5a09fa4006dae30e37f077b9505050f1155597b6ce04b5d9807a59
ready=0
for attempt in $(seq 1 30); do
  if sudo podman exec nested-docker docker info >/dev/null 2>&1; then ready=1; break; fi
  sleep 2
done
if [ "$ready" -eq 1 ]; then sudo podman exec nested-docker docker info; else sudo podman logs nested-docker; fi
sudo podman stop nested-docker
test "$ready" -eq 1

This fixture does not use the host Docker socket. Read the detailed guide for nested workloads.

Support and runtime contract¶

Lifecycle: maintained; admission: isolated-test; review after: 2026-10-27.

Vendor package revisions can advance with repository updates; image shares runner kernel and host security policy.

Declared runtime profiles: docker. Declared test settings are in the metadata source. Admission is policy, not evidence of a passed test.

Declared runtime test contract:

{
  "docker": {
    "mode": "rootless",
    "nestedRuntime": true,
    "outerPrivilege": "privileged"
  }
}

Registry aliases and history¶

Aliases resolved to the observed current digest: latest, main, v1, v1.0, v1.0.0.

Listed without digest resolution: run-36346260768-1-sha-0b136a13a8bb612d91960ae5d07e72f449c89ec1, run-36406523319-1-sha-c7db148388c855b6e42bb5ec046a6ee1f998ab43, sha-0b136a13a8bb612d91960ae5d07e72f449c89ec1, sha-c7db148388c855b6e42bb5ec046a6ee1f998ab43, sha256-6e63fb4eacb25a3ee6a4b61fec648613f116543a587c68bd52190656f4006893, sha256-86509874ee1f120827543fdd1159a92f34e1c95d056405f3edb78366fd9b8d93, sha256-b885ad1ffe5a09fa4006dae30e37f077b9505050f1155597b6ce04b5d9807a59, sha256-c26447d517fac54b359ef10f891545b55e1c0a3284e6df0f73a3ed8536830ebe, sha256-d6891e2487d65a2e074b1c8f361a8b935a3908aa4a87126255c142d0db9b9d97, sha256-e85e0d201455bca580e177578fd551a6ff7bd7a321946a186a742a7cc1abd0cf.

Evidence and timestamps¶

Matching release asset verified the build record and per-architecture runtime and scan evidence. Signature and provenance remain unverified in this snapshot.

Maintenance release · Evidence asset

GitHub package activity can include signatures and attestations; it does not identify when the current runnable image was published. A registry observation is a point-in-time check; mutable tags may move afterward. Use the immutable digest and maintenance evidence for an audit.