Base-image graph
Bases
Which images are built on which, how each relationship is known, and how far each image is behind the newest version of its base that this run observed.
4
✓ Proven
base established by layer digests
0
○ Claimed
base named by the image's author, not checked
0
Unresolved
no base could be determined
4
Roots
base images, or built from scratch
4
✓ Current
on the newest observed version of their base
0
✓ Stale
a newer version of their base was observed
Graph
cgr.dev/chainguard/static · static:latest Unverified. At least one requirement couldn't be decided. Not a pass, and not a failure.
Newest observed: cgr.dev/chainguard/static:latest sha256:fe55470f22d3, created 2026-10-01 · 1 consumer on 1 version
hello-app:latest Proven. By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. Current. On the newest version of its base observed in this run. on
cgr.dev/chainguard/static:latestsha256:fe55470f22d3
cgr.dev/chainguard/wolfi-base · wolfi-base:latest Unverified. At least one requirement couldn't be decided. Not a pass, and not a failure.
Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:1c451d46a0d5, created 2026-10-09 · 1 consumer on 1 version
platform-tools:latest Proven. By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. Current. On the newest version of its base observed in this run. on
cgr.dev/chainguard/wolfi-base:latestsha256:1c451d46a0d5
docker.io/library/amazonlinux · amazonlinux:2023 Failed. Violates at least one requirement in the policy.
Newest observed: docker.io/library/amazonlinux:2023 sha256:8ed3c0a99684, created 2026-10-05 · 1 consumer on 1 version
amazonlinux-tools:latest Proven. By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. Current. On the newest version of its base observed in this run. on
docker.io/library/amazonlinux:2023sha256:8ed3c0a99684
docker.io/library/debian · debian:trixie-slim Failed. Violates at least one requirement in the policy.
Newest observed: docker.io/library/debian:trixie-slim sha256:a29215f6a35e, created 2026-10-05 · 1 consumer on 1 version
debian-tools:latest Proven. By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. Current. On the newest version of its base observed in this run. on
docker.io/library/debian:trixie-slimsha256:a29215f6a35e
Stale
No image is behind the newest observed version of its base.
How a base is known
| Strength | Method | What it means |
|---|---|---|
| Proven. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. | layer digests | The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. |
| Declared. An exact claim the image's author wrote (a label or annotation naming the base). Not checked against the layers. | OCI base-digest annotation, Buildpacks metadata | An exact claim the image's author wrote (a label or annotation naming the base). Not checked against the layers. |
| Assisted. A partial claim by the image's author: it names the base repository but not the version. | OCI base-name annotation | A partial claim by the image's author: it names the base repository but not the version. |
| Weak. The base repository appears in the image's build history. A hint, not evidence. | build history | The base repository appears in the image's build history. A hint, not evidence. |
4 relationships proven, 0 claims. Only layer digests are proof.