Debian 13 Podman rootless¶

Debian 13 distro-packaged Podman rootless compatibility image for CI

Image: ghcr.io/strukturpiloten/podman-debian-13-rootless
Declared image version: v1.0.0
Family: Podman
Architecture: amd64, arm64
Inner mode: rootless

Declared runtime base: docker.io/library/debian:13@sha256:9cc080028c43b27d2074d63a5f9caf7166d731494965616c1a6d2827a004585c

Image source and metadata · GHCR package · Detailed guide

Choose and inspect¶

The distribution selects the installed engine package at build time. Inspect the published image's component manifest or SBOM for its exact revision.

Declared tags: v1.0.0, v1.0, v1, main, latest. These are publication policy aliases, not proof that any tag exists in GHCR. Even the exact SemVer tag can move after a reviewed rebuild.

Registry status: observed; checked at 2026-09-28T10:17:16.110842+00:00.

Observed latest index digest: sha256:13608fe6fb9889ea572ac7a2c95c8497fac97d10f6f5ce878b2f2c3718f94495.

Pull the observed immutable artifact:

podman pull ghcr.io/strukturpiloten/podman-debian-13-rootless@sha256:13608fe6fb9889ea572ac7a2c95c8497fac97d10f6f5ce878b2f2c3718f94495

A CLI check can run without a nested workload:

podman run --rm ghcr.io/strukturpiloten/podman-debian-13-rootless:v1.0.0 podman --version

Nested workloads require the profile-specific outer privilege and device setup in the detailed guide. Some rootless distro profiles intentionally omit nested workload checks.

Support and runtime contract¶

Lifecycle: maintained; admission: isolated-test; review after: 2026-12-31.

Repository rebuilds refresh distribution packages; vendor support determines installed Podman security maintenance.

Declared runtime profiles: podman. Declared test settings are in the metadata source. Admission is policy, not evidence of a passed test.

Declared runtime test contract:

{
  "podman": {
    "mode": "rootless",
    "outerPrivilege": "privileged"
  }
}

Registry aliases and history¶

Aliases resolved to the observed current digest: latest, main, v1, v1.0, v1.0.0.

Listed without digest resolution: run-32739402388-1-sha-f0259a080e8a49be43358fc00c4cac89528d4954, run-32808812826-1-sha-34e7193852a44ffade6d186f9c664368856ccb6c, run-32913970262-1-sha-880173ac9c97c768b3e5e64357a7b7a7c4f9bfe8, run-32930106309-1-sha-36f12397c825a765d498654657c2cfa99ae413c9, run-33084138768-1-sha-501915f06c2f36c0254a08ad5c70ae9ec14c9a64, run-33304142817-1-sha-30faee7ada474e455a43b7abf2d90bbf24977056, run-33369549209-1-sha-8ba6168227ce22ebd58ab732a665d717cbcd54ab, run-33380856986-1-sha-699c4fd9be1a508c33387aa87e6211de92d6e480, run-35436854454-1-sha-db5295447e925c9736b9aaed869a53d3a106a1ef, run-36320630115-1-sha-73e79fd9ca8cffa73bd60d360c8db2929271d48a, run-36346260768-1-sha-0b136a13a8bb612d91960ae5d07e72f449c89ec1, sha-0b136a13a8bb612d91960ae5d07e72f449c89ec1, sha-73e79fd9ca8cffa73bd60d360c8db2929271d48a, sha-880173ac9c97c768b3e5e64357a7b7a7c4f9bfe8, sha-8ba6168227ce22ebd58ab732a665d717cbcd54ab, sha-db5295447e925c9736b9aaed869a53d3a106a1ef, sha-f0259a080e8a49be43358fc00c4cac89528d4954, sha256-0334666fee381d5db05f4dd378e3fecb4b0c89113c63d7da81f36da4ce278f02, sha256-0e1723d6389f53146208899b721fcf1c481349d21512d45d681507cb8b69025a, sha256-0e178d5dd629ad378ab7e1ed57ed084b7f0d4d344495498ba32647d0da102c7f, sha256-13066145e8162d823114826713805e2550b57f1cbd33c8c006ff5f0f2a42eb23, sha256-13608fe6fb9889ea572ac7a2c95c8497fac97d10f6f5ce878b2f2c3718f94495, sha256-2492296cc4bbeb7338f231c393b741856e536749b92ab7896f2ffbe82a3098d8, sha256-303c36e917db197fd448ada5304b0fca0811e713d057aa67999ea7c409ba22a1, sha256-3ad1adc452b7f048916f1476fef9beb0219ed00ea8f6ee8ba276e65a6e1ffb07, sha256-3ccba02e52551ef4b80fbc3269f783d47fe92de3b97942db57565cf7b2d032e7, sha256-3ec44c8bd78f1371e9ed8f0d665edae2261448f853bbad7ba97a54f1620f8d3d, sha256-45d804edd350eb785974292544969a7ee5a95d57926f96dcb2cb37f274686af4, sha256-4af274179125e785ca9e736e3af5d0f95f5347f77b9b3990e75c8a3435d962dc, sha256-5998e5474e392d1419c760fc45cd035d6a9a129b4b5556b1cbf366b7e524dd82, sha256-5d20c7677dad55defd2df3d00a31751de6a1070f087be733e3683341e292ba9b, sha256-80b29a3d04bfbcbb9c04cf677136ccf7fd4f917a1214eaebe311b3fb4a65fc23, sha256-812e6036269cd8f15c77f5a3b90ace7f7be6f407d6540efd3b57e571f3e6fd26, sha256-839c96af6c3b25b6b698eff7208e73f5fd37e9e88273a8280fa81111f0f0deba, sha256-84fb2823618d9b264060822ff5db0a4bfd6a58192ea6cde06d4177b17bf00107, sha256-8f23aef1bbc6f995775c12972461bc31e67455600bd5d611aa5ce85df28dc7e1, sha256-9508ea0d68098f90fa46528311e94087bedeac7ec6467ae17fe9ade57004d051, sha256-b2a4171ea60f97607aee1955a1bd158ef552a13595aa7e194537850dee2cfc60, sha256-bb2d13592770d7b4c87aa96afee17bede39312716fb93cb425ba601daac53848, sha256-bece73df616fd25ff9b2e9b164c3afebaf08046820088f565afc839ec33d8dd3, sha256-c3cc0334137c158edb24d515be238d7397d9cb1b47187005f43a46e26361514c, sha256-d600ca7ceef148b1e0df917cd9999dda6a9878a6a9aab9969b51abf7b35aac00, sha256-d7670e3e5ec4ff89bcaffbea4d5ccc1829658a78e00b99b5d12fb91a121fdc38, sha256-d7d9d1e9e3cec35e9663adeea12fa00b06738bcaffe5b07bd033b8ff0b841f0a, sha256-e2ac361e0eca41de4375070073f451cf220d32303df995560bbb0db7293f9607, sha256-e4d6c9c2e4205f0bd09b504873c25cd69beb1b9091dbf2b7502c0e43196805f4, sha256-e5bdcea67b55d100bfd9c7068efa965a2d2bab4eaba019b963d063366b04ad01, sha256-ee5abc87a4509e36a95e884d59b37a60a1567655c447555b1b7f34834cb3f085, sha256-f39ac97c6e6ab7665e592477232390568af776511047ff53a48edb84aab368e2, sha256-f757e8c36ad5baa352bbc0f2b385ca531977898b6a84de3a0def2cc98c2548ac.

Evidence and timestamps¶

Matching release asset verified the build record and per-architecture runtime and scan evidence. Signature and provenance remain unverified in this snapshot.

Maintenance release · Evidence asset

GitHub package activity can include signatures and attestations; it does not identify when the current runnable image was published. A registry observation is a point-in-time check; mutable tags may move afterward. Use the immutable digest and maintenance evidence for an audit.