Base-image graph

Bases

Which images are built on which, how each relationship is known, and how far each image is behind the newest version of its base that this run observed.

✓ Proven

base established by layer digests

○ Claimed

base named by the image's author, not checked

Unresolved

no base could be determined

Roots

base images, or built from scratch

✓ Current

on the newest observed version of their base

! Stale

a newer version of their base was observed

Graph

cgr.dev/chainguard/wolfi-base

Newest observed: cgr.dev/chainguard/wolfi-base:latest sha256:e2d3af72b200 (its linux/amd64 image) · 6 consumers on 1 version, 6 stale

build-go:1 By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. A newer version of its base was observed in this run. on cgr.dev/chainguard/wolfi-base:latest sha256:030e45cb3718 (its linux/amd64 image)
build-node:24 By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. A newer version of its base was observed in this run. on cgr.dev/chainguard/wolfi-base:latest sha256:030e45cb3718 (its linux/amd64 image)
build-python:3.14 By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. A newer version of its base was observed in this run. on cgr.dev/chainguard/wolfi-base:latest sha256:030e45cb3718 (its linux/amd64 image)
run-go:1 By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. A newer version of its base was observed in this run. on cgr.dev/chainguard/wolfi-base:latest sha256:030e45cb3718 (its linux/amd64 image)
ghcr.io/northcutted/clearcutt-showcase/platform/run-go · run-go:1 Meets every requirement in the policy.
Newest observed: ghcr.io/northcutted/clearcutt-showcase/platform/run-go:1 sha256:f6a0ee0f0f63, created 2026-10-16 · 1 consumer on 1 version
- checkout:latest By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. On the newest version of its base observed in this run. on ghcr.io/northcutted/clearcutt-showcase/platform/run-go:1 sha256:f6a0ee0f0f63
run-node:24 By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. A newer version of its base was observed in this run. on cgr.dev/chainguard/wolfi-base:latest sha256:030e45cb3718 (its linux/amd64 image)
ghcr.io/northcutted/clearcutt-showcase/platform/run-node · run-node:24 Meets every requirement in the policy.
Newest observed: ghcr.io/northcutted/clearcutt-showcase/platform/run-node:24 sha256:e3620169865a, created 2026-10-16 · 1 consumer on 1 version
- storefront:latest By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. On the newest version of its base observed in this run. on ghcr.io/northcutted/clearcutt-showcase/platform/run-node:24 sha256:e3620169865a
run-python:3.14 By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. A newer version of its base was observed in this run. on cgr.dev/chainguard/wolfi-base:latest sha256:030e45cb3718 (its linux/amd64 image)
ghcr.io/northcutted/clearcutt-showcase/platform/run-python · run-python:3.14 Meets every requirement in the policy.
Newest observed: ghcr.io/northcutted/clearcutt-showcase/platform/run-python:3.14 sha256:daf68a5f8a3b, created 2026-10-16 · 1 consumer on 1 version
- catalog:latest By layer digests, comparing the linux/amd64 images. The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself. On the newest version of its base observed in this run. on ghcr.io/northcutted/clearcutt-showcase/platform/run-python:3.14 sha256:daf68a5f8a3b

Stale

Image	Base	Newest observed	How it's known	Versions behind	Days behind
build-go:1	cgr.dev/chainguard/wolfi-base:latest	cgr.dev/chainguard/wolfi-base:latest	The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.	1	5
build-node:24	cgr.dev/chainguard/wolfi-base:latest	cgr.dev/chainguard/wolfi-base:latest	The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.	1	5
build-python:3.14	cgr.dev/chainguard/wolfi-base:latest	cgr.dev/chainguard/wolfi-base:latest	The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.	1	5
run-go:1	cgr.dev/chainguard/wolfi-base:latest	cgr.dev/chainguard/wolfi-base:latest	The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.	1	5
run-node:24	cgr.dev/chainguard/wolfi-base:latest	cgr.dev/chainguard/wolfi-base:latest	The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.	1	5
run-python:3.14	cgr.dev/chainguard/wolfi-base:latest	cgr.dev/chainguard/wolfi-base:latest	The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.	1	5

How a base is known

Strength	Method	What it means
The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.	layer digests	The image starts with the base's exact layer digests. This compares content, so it holds whatever the image says about itself.
An exact claim the image's author wrote (a label or annotation naming the base). Not checked against the layers.	OCI base-digest annotation, Buildpacks metadata	An exact claim the image's author wrote (a label or annotation naming the base). Not checked against the layers.
A partial claim by the image's author: it names the base repository but not the version.	OCI base-name annotation	A partial claim by the image's author: it names the base repository but not the version.
The base repository appears in the image's build history. A hint, not evidence.	build history	The base repository appears in the image's build history. A hint, not evidence.

9 relationships proven, 0 claims. Only layer digests are proof.