INDIAN HILLLABS ACCESS THE LAB ↗
WEB PLATFORMS // IHL-CTR-0008

Apache Tomcat

A Java servlet platform for deploying your own web applications.

VIEW IMAGE SOURCE ↗
SecureHardened
LINUX / AMD64ENGINEERING PREVIEW
GET THE IMAGE // SECURE

PULL. PIN. VERIFY.

GHCR // ANONYMOUS PULL
docker pull --platform linux/amd64 \
  ghcr.io/foxtech-consulting/tomcat@sha256:b64184133371ed6b8140d9a8224be458cf18b8ee337b079ca9ed3a44a5b2c561

Anonymous pull verified Oct 15, 2026, 8:31 PM EDT. Pin this digest in Compose or Kubernetes.

Version 10.1.59 · Apache Tomcat Secure · Open GHCR package ↗

BEFORE YOU RUN

MADE FOR YOUR WORKLOAD.

Requirements from the public source recipes. Review the exact selected image and configuration before use.

  1. The runtime ships without a deployed web application; add yours under /opt/tomcat/webapps before starting it.
  2. The HTTP connector listens on port 8080 and the shutdown port is disabled.
  3. Automatic deployment and WAR unpacking are disabled in the supplied Host configuration.
  4. Runs as UID/GID 1654:1654; the public reference application is supplied as a separate workload example.

Read the source recipe ↗ · Local build instructions ↗. Local builds remain unqualified.

KEEP THE CHAIN OF EVIDENCE

INSPECT WHAT YOU PULL.

The download check, publication signature, and source binding are separate records.

✓Anonymous bytes checked

Manifest, configuration, and every referenced layer.

✓Publication CI signature

Recorded verification and complete signed annotations.

✓Public source bound

Signed GitHub snapshot identity is recorded.

The anonymous byte check did not repeat cryptographic signature verification or execute the runtime. Publication evidence ↗ may require GitLab access.

Verify this exact image with Cosign
COSIGN // ALL RECORDED ANNOTATIONS
cosign verify \
  --certificate-oidc-issuer https://gitlab.com \
  --certificate-identity https://gitlab.com/indianhilllabs/indian-hill-secure-containers//.gitlab-ci.yml@refs/heads/main \
  -a assurance-manifest-sha256=33259b725d41bf64492901098c299be1ab6ede3e66a64ff0d6f5ead3019df803 \
  -a assurance-tier=secure \
  -a public-source-commit=73df508adc971ed22dac211004989029e8df3fc5 \
  -a public-source-manifest-sha256=952c34e28dd192ca42d082d4d305a106954bc04664a0c57c0fc6a8e0512266b0 \
  -a publication-context=engineering-candidate \
  -a publisher-revision=82b76e51f07fc90d67d73cb000b4767ebef43b77 \
  -a release-registry=github-container-registry \
  -a source-revision=25dfe5ef14bbdac60ee9594c63ecc87007bad8f2 \
  ghcr.io/foxtech-consulting/tomcat@sha256:b64184133371ed6b8140d9a8224be458cf18b8ee337b079ca9ed3a44a5b2c561

Requires Cosign. This command checks the recorded issuer, exact identity, digest, and every signed annotation for this publication.

RECORDED FINDINGS

AT QUALIFICATION // NOT A LIVE SCAN
0CRITICAL
0HIGH
6MEDIUM
0LOW

7 total matches · 1 negligible · 0 unknown · 0 CISA KEV matches. Secure reports findings without making every finding a publication blocker.

These are engineering previews. Tier names and successful checks do not declare general availability, FIPS validation, or qualification of your deployment. Read the verification guide →

DATA SOURCE // GitHub public catalog ↗ · Snapshot 0a9c87b8 · Retrieved Oct 16, 2026, 4:34 PM EDT.
Catalog inventory record updated Oct 16, 2026, 3:52 PM EDT. Individual image and blob checks retain their original timestamps. This website uses a pinned GitHub snapshot. These checks are recorded evidence, not new scans or downloads performed by this page.