Debian 12 Podman rootful¶

Debian 12 distro-packaged Podman rootful compatibility image for CI

Image: ghcr.io/strukturpiloten/podman-debian-12-rootful
Declared image version: v1.0.0
Family: Podman
Architecture: amd64, arm64
Inner mode: rootful

Declared runtime base: docker.io/library/debian:12@sha256:f37a335e82bca302e955fa39f9dfe28f1be618f016f8a2b56318e5a5111afc26

Image source and metadata · GHCR package · Detailed guide

Choose and inspect¶

The distribution selects the installed engine package at build time. Inspect the published image's component manifest or SBOM for its exact revision.

Declared tags: v1.0.0, v1.0, v1, main, latest. These are publication policy aliases, not proof that any tag exists in GHCR. Even the exact SemVer tag can move after a reviewed rebuild.

Registry status: observed; checked at 2026-09-28T10:17:14.339556+00:00.

Observed latest index digest: sha256:bf59c8563264c53042e335cc8584e42c4600b919571a2b03979c09f08cce7fa5.

Pull the observed immutable artifact:

podman pull ghcr.io/strukturpiloten/podman-debian-12-rootful@sha256:bf59c8563264c53042e335cc8584e42c4600b919571a2b03979c09f08cce7fa5

A CLI check can run without a nested workload:

podman run --rm ghcr.io/strukturpiloten/podman-debian-12-rootful:v1.0.0 podman --version

Nested workloads require the profile-specific outer privilege and device setup in the detailed guide. Some rootless distro profiles intentionally omit nested workload checks.

Support and runtime contract¶

Lifecycle: maintained; admission: isolated-test; review after: 2026-12-31.

Repository rebuilds refresh distribution packages; vendor support determines installed Podman security maintenance.

Declared runtime profiles: podman. Declared test settings are in the metadata source. Admission is policy, not evidence of a passed test.

Declared runtime test contract:

{
  "podman": {
    "mode": "rootful",
    "outerPrivilege": "privileged"
  }
}

Registry aliases and history¶

Aliases resolved to the observed current digest: latest, main, v1, v1.0, v1.0.0.

Listed without digest resolution: run-32739402388-1-sha-f0259a080e8a49be43358fc00c4cac89528d4954, run-32808812826-1-sha-34e7193852a44ffade6d186f9c664368856ccb6c, run-32930106309-1-sha-36f12397c825a765d498654657c2cfa99ae413c9, run-33034060210-1-sha-61be8863cafe552a0d4568508767116517a034aa, run-33084138768-1-sha-501915f06c2f36c0254a08ad5c70ae9ec14c9a64, run-33304142817-1-sha-30faee7ada474e455a43b7abf2d90bbf24977056, run-33369549209-1-sha-8ba6168227ce22ebd58ab732a665d717cbcd54ab, run-33380856986-1-sha-699c4fd9be1a508c33387aa87e6211de92d6e480, run-35423428841-1-sha-a4b8693d12f94f5ad831da60cd739d92b9b762f0, run-36320630115-1-sha-73e79fd9ca8cffa73bd60d360c8db2929271d48a, run-36346260768-1-sha-0b136a13a8bb612d91960ae5d07e72f449c89ec1, sha-0b136a13a8bb612d91960ae5d07e72f449c89ec1, sha-61be8863cafe552a0d4568508767116517a034aa, sha-73e79fd9ca8cffa73bd60d360c8db2929271d48a, sha-8ba6168227ce22ebd58ab732a665d717cbcd54ab, sha-a4b8693d12f94f5ad831da60cd739d92b9b762f0, sha-f0259a080e8a49be43358fc00c4cac89528d4954, sha256-1739218f8387aa80d460811084ba76df060ec430f48d96334921aae8ca2a0458, sha256-2b50ee100ef0e9d1cd5f1a55a21ed760afd4df546acc99bcf43007dcccfb1a0e, sha256-3486d881e4dfdb3d0c73d3b0799aba4bedf186f3387b4ecf6568ec9c00cc6542, sha256-40b30a4661e14faba2477e7fe2f38ad3950c9f6dcf6fcd96ce3f3581d0118a10, sha256-42a2d5ff2ae5ef95e6377c82b992f34d687b4ba66cd8d0fc87ebbeb9b7f0a74f, sha256-45cbbacc2e3aeab8081797add04a3474b5661718eceb415b4ed7d92f550389e0, sha256-484a8df591500611b016151e9e0e1ffb4a45caeb548eb8e5cec9356eba081639, sha256-4ed084c64acf581d0aeffea1c5f7e30af82e6d7e1d6f695ff2575778c34b6d05, sha256-5639655374354c3f1a884cb907dd3c997c29903a4e35d7d4f1ce138805eaff9c, sha256-5f7b003095dc0b3ed471b932f92b4000a8ed9fab4100a32d7a6a42876f78bcad, sha256-6a66f36c0bb1c7845982488aaff5a45d062660749d1f89d5adddf278c5ad40e0, sha256-6ffd005604d4d645e08b3ac889c0ecda44b58acd844f4bce1fe27ced3d7d3896, sha256-7c2cbac44a6d1c78d6094c310cfbe93175cacccee2897e80c745cad8a10a33e6, sha256-7e95c306491c6a7a03ad92ca9a185db55d9d79ee01fe2a13a5059ea739e5a8c9, sha256-8ba85ba3c1346e3cedfc559f2c2e40844808c87c7a74daaec2de566cea0248f5, sha256-90695eff3942cfdf6f1660de4b84c8ebb8495c12315fb287c1d74667aaaa47b3, sha256-914e04d86ef25fa9186c65ea503c7e3f1dc1eeaf3a2c1be978f1ff2e29dac2a0, sha256-94548b0ce95b2f76d5b4dcf9d516d7df81cf822ae339da5e80407296280d046e, sha256-9550f3944cb8a86f18fd3009582f0513e4e8f7c940c41156cd246f7b6c217df7, sha256-9fa668a8355faf7b0b3999a9ef4db3742e6924c36f395eb2e75b5bec79bfe854, sha256-acd13d0ed096a751bc5417df60db47e0dadca02dfac3456b0f58bfb254118da3, sha256-afaf1df01039ab6606140e9440b7987ce520344d086e82cf3d2b18f820a8b0e6, sha256-b1fd4d164a7a1feb8dae033f763aeef578f24e32bca02e3fcca8e83455c1375a, sha256-b2c384cd1099641343a1a0e0499d07c4781da593cadce3031785722888ff328c, sha256-bf59c8563264c53042e335cc8584e42c4600b919571a2b03979c09f08cce7fa5, sha256-c01f9fbc3a77e6c665d5bbeb683b053b39864c50425da3210bcfb4516a4a4047, sha256-c450c02c8b0f1c9d7ed484836931031aa1034ded8bf08ed08bba1e6a7cc479ca, sha256-c512c55b8504699cc685dd9e924d7592dadb4d7a41cf85425d1c87ecc8ac86a5, sha256-d9edfa8dc04679ccc6a97635518dc4b76e298349d67c4ce734bf2e0a161b91e2, sha256-e90bff8575e2e8c8717110fd21a1002be06718ae668b6c835d39a447592e076f, sha256-fb62cbbdc1c26836b0896fcbe5e3a73eae5d19057e4d665f73bd8bc3064d5ff7, sha256-fc770518dbab2ab842dac99dec743d0d196bb5e9a45eebd2187681ab78cf7bb0, sha256-fdf06ceac3b7e93497674ebc1148442da3fae84671ab47cd2af3612f7fe27b81.

Evidence and timestamps¶

Matching release asset verified the build record and per-architecture runtime and scan evidence. Signature and provenance remain unverified in this snapshot.

Maintenance release · Evidence asset

GitHub package activity can include signatures and attestations; it does not identify when the current runnable image was published. A registry observation is a point-in-time check; mutable tags may move afterward. Use the immutable digest and maintenance evidence for an audit.