INDIAN HILLLABS ACCESS THE LAB ↗
DATA PLATFORMS // IHL-CTR-0004

PostgreSQL

A PostgreSQL server with an explicit data-directory, credential, and initialization contract.

VIEW IMAGE SOURCE ↗
SecureHardened
LINUX / AMD64ENGINEERING PREVIEW
GET THE IMAGE // SECURE

PULL. PIN. VERIFY.

GHCR // ANONYMOUS PULL
docker pull --platform linux/amd64 \
  ghcr.io/foxtech-consulting/postgres@sha256:07105fbc57d0be4fc289b2eede8bb5fe0bfc0bebc5683110da3f191e894d99a7

Anonymous pull verified Oct 15, 2026, 8:30 PM EDT. Pin this digest in Compose or Kubernetes.

Version 16.15 · PostgreSQL Secure · Open GHCR package ↗

BEFORE YOU RUN

MADE FOR YOUR WORKLOAD.

Requirements from the public source recipes. Review the exact selected image and configuration before use.

  1. Provide persistent storage at /var/lib/postgresql/data, writable by UID/GID 1654:1654; first initialization requires an empty data directory.
  2. Supply deployment credentials through POSTGRES_PASSWORD_FILE; the bootstrapper initializes a cluster only when PG_VERSION is absent.
  3. The supplied server configuration listens on port 5432 and uses SCRAM-SHA-256 password encryption.
  4. The supplied configuration defaults to ssl=off; provide certificates and enable TLS in your deployment configuration.

Read the source recipe ↗ · Local build instructions ↗. Local builds remain unqualified.

KEEP THE CHAIN OF EVIDENCE

INSPECT WHAT YOU PULL.

The download check, publication signature, and source binding are separate records.

✓Anonymous bytes checked

Manifest, configuration, and every referenced layer.

✓Publication CI signature

Recorded verification and complete signed annotations.

✓Public source bound

Signed GitHub snapshot identity is recorded.

The anonymous byte check did not repeat cryptographic signature verification or execute the runtime. Publication evidence ↗ may require GitLab access.

Verify this exact image with Cosign
COSIGN // ALL RECORDED ANNOTATIONS
cosign verify \
  --certificate-oidc-issuer https://gitlab.com \
  --certificate-identity https://gitlab.com/indianhilllabs/indian-hill-secure-containers//.gitlab-ci.yml@refs/heads/main \
  -a assurance-manifest-sha256=e17e5798634f5a5d0a069e003a77162bab350538b34f2fab0cac68d3e0d2d1f8 \
  -a assurance-tier=secure \
  -a public-source-commit=73df508adc971ed22dac211004989029e8df3fc5 \
  -a public-source-manifest-sha256=952c34e28dd192ca42d082d4d305a106954bc04664a0c57c0fc6a8e0512266b0 \
  -a publication-context=engineering-candidate \
  -a publisher-revision=82b76e51f07fc90d67d73cb000b4767ebef43b77 \
  -a release-registry=github-container-registry \
  -a source-revision=25dfe5ef14bbdac60ee9594c63ecc87007bad8f2 \
  ghcr.io/foxtech-consulting/postgres@sha256:07105fbc57d0be4fc289b2eede8bb5fe0bfc0bebc5683110da3f191e894d99a7

Requires Cosign. This command checks the recorded issuer, exact identity, digest, and every signed annotation for this publication.

RECORDED FINDINGS

AT QUALIFICATION // NOT A LIVE SCAN
0CRITICAL
0HIGH
6MEDIUM
0LOW

7 total matches · 1 negligible · 0 unknown · 0 CISA KEV matches. Secure reports findings without making every finding a publication blocker.

These are engineering previews. Tier names and successful checks do not declare general availability, FIPS validation, or qualification of your deployment. Read the verification guide →

DATA SOURCE // GitHub public catalog ↗ · Snapshot 0a9c87b8 · Retrieved Oct 16, 2026, 4:34 PM EDT.
Catalog inventory record updated Oct 16, 2026, 3:52 PM EDT. Individual image and blob checks retain their original timestamps. This website uses a pinned GitHub snapshot. These checks are recorded evidence, not new scans or downloads performed by this page.