WEB PLATFORMS // IHL-CTR-0002

NGINX

An HTTP server for serving your site content with explicit, reviewable configuration.

LINUX / AMD64ENGINEERING PREVIEW

GET THE IMAGE // SECURE

PULL. PIN. VERIFY.

GHCR // ANONYMOUS PULL

docker pull --platform linux/amd64 \
  ghcr.io/foxtech-consulting/nginx@sha256:2c6bd01ba8269ce8fd2fe6cddacf598db5cc2ae8ec53f4b3e158b1060ddcbe19

Anonymous pull verified Oct 16, 2026, 3:37 PM EDT. Pin this digest in Compose or Kubernetes.

Version 1.30.6 · NGINX Secure · Open GHCR package ↗

BEFORE YOU RUN

MADE FOR YOUR WORKLOAD.

Requirements from the public source recipes. Review the exact selected image and configuration before use.

Choose the Stable 1.30 or Mainline 1.31 build target. Mainline currently declares only a Secure recipe; no Mainline Hardened recipe or download is listed.
The shared Dockerfile defaults to Stable. Use the public build helper and the selected target's declared version, source checksum, version line and artifact ID overrides when building Mainline locally.
Add your site content under /usr/share/nginx/html.
The supplied configuration listens on port 8080 and serves a tier-specific health document at /healthz.
Provide writable /tmp storage for the PID and temporary request files.
Runs as UID/GID 1654:1654; the Hardened configuration permits GET and HEAD for site content.

Read the source recipe ↗ · Local build instructions ↗. Local builds remain unqualified.

KEEP THE CHAIN OF EVIDENCE

INSPECT WHAT YOU PULL.

The download check, publication signature, and source binding are separate records.

✓Anonymous bytes checked

Manifest, configuration, and every referenced layer.

✓Publication CI signature

Recorded verification and complete signed annotations.

✓Public source bound

Signed GitHub snapshot identity is recorded.

The anonymous byte check did not repeat cryptographic signature verification or execute the runtime. Publication evidence ↗ may require GitLab access.

Verify this exact image with Cosign

COSIGN // ALL RECORDED ANNOTATIONS

cosign verify \
  --certificate-oidc-issuer https://gitlab.com \
  --certificate-identity https://gitlab.com/indianhilllabs/indian-hill-secure-containers//.gitlab-ci.yml@refs/heads/main \
  -a assurance-tier=secure \
  -a source-revision=c361b29a50f20ba9300d7b1324f737da41185073 \
  -a assurance-manifest-sha256=9e860b5594301b55d2d0641e8054c792ca53c57812c02f5adb2a8541446d5c9d \
  -a public-source-commit=946fffc8f721a7a81855813610f53268c668b557 \
  -a public-source-manifest-sha256=236c03b6e16f79b91d7122cdadc13aeca25dad8a5139340632d1beb86b663006 \
  -a publication-context=engineering-candidate \
  -a release-registry=github-container-registry \
  ghcr.io/foxtech-consulting/nginx@sha256:2c6bd01ba8269ce8fd2fe6cddacf598db5cc2ae8ec53f4b3e158b1060ddcbe19

Requires Cosign. This command checks the recorded issuer, exact identity, digest, and every signed annotation for this publication.

RECORDED FINDINGS

AT QUALIFICATION // NOT A LIVE SCAN

0CRITICAL

0HIGH

6MEDIUM

0LOW

7 total matches · 1 negligible · 0 unknown · 0 CISA KEV matches. Secure reports findings without making every finding a publication blocker.

These are engineering previews. Tier names and successful checks do not declare general availability, FIPS validation, or qualification of your deployment. Read the verification guide →

DATA SOURCE // GitHub public catalog ↗ · Snapshot 0a9c87b8 · Retrieved Oct 16, 2026, 4:44 PM EDT.
Catalog inventory record updated Oct 16, 2026, 3:52 PM EDT. Individual image and blob checks retain their original timestamps. This website uses a pinned GitHub snapshot. These checks are recorded evidence, not new scans or downloads performed by this page.