Clearcutt Catalog
Reference Catalog
?
Service 16 · Service · postgres image

clearcutt-postgres16 : postgres

First-class postgres image with template-owned ports, storage, lifecycle, and smoke checks.

v0.10.4 amd64arm64 Status: preview Support: CURRENT Non-Prod Only Signature: Verified Provenance: Verified SBOM: Verified Vulnerability scan: Missing Tests: Verified Evidence overlays listed maintenance-stale
Multi-arch Manifest Digest:
sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974
Lifecycle Advisory: PREVIEW IMAGE

This image is currently in Preview status. It has catalog evidence, but is not recommended for production environments until general availability.

Published Tue, 09 Jun 2026 12:54:17 GMT

Last Rebuilt Tue, 09 Jun 2026 12:54:17 GMT

Scan data missing
1

Service Image Usage

Run the platform service, inspect its operational contract, and verify the evidence attached to this release.

Service Contract

postgres16 is a platform-owned service image. It is built from the fleet service template, cataloged separately from runtime tiers, and carries ports, storage, lifecycle, smoke, vulnerability, and evidence metadata.

Templatepostgres16
Lifecyclepreview / non-production
Portspostgres:5432/tcp
Storage/var/lib/postgresql/data
Entrypoint/bin/clearcutt-postgres-entrypoint
Runtime UserUID 10001:10001
Smokeconfigured
Vulnerabilitiesscan pending

Configured Smoke Commands

  • postgres --version
  • initdb --version
  • pg_isready --version

Pull & Run Service

Use digest-pinned pulls when available; mount volumes for stateful data dirs.

Pull by multi-arch digest

docker pull ghcr.io/northcutted/clearcutt/clearcutt-postgres16@sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974

Pinned service tag

docker pull ghcr.io/northcutted/clearcutt/clearcutt-postgres16:v0.10.4-service

Run service

docker run --rm \
  --user 10001:10001 \
  -p 5432:5432 \
  -v postgres16-data-1:/var/lib/postgresql/data \
  ghcr.io/northcutted/clearcutt/clearcutt-postgres16:v0.10.4-service

Pull by multi-arch digest

podman pull ghcr.io/northcutted/clearcutt/clearcutt-postgres16@sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974

Pinned service tag

podman pull ghcr.io/northcutted/clearcutt/clearcutt-postgres16:v0.10.4-service

Run service

podman run --rm \
  --user 10001:10001 \
  -p 5432:5432 \
  -v postgres16-data-1:/var/lib/postgresql/data \
  ghcr.io/northcutted/clearcutt/clearcutt-postgres16:v0.10.4-service
docker-compose.yml yaml
services:
  postgres16:
    image: ghcr.io/northcutted/clearcutt/clearcutt-postgres16:v0.10.4-service
    user: "10001:10001"
    ports:
      - "5432:5432"
    volumes:
      - postgres16-data-1:/var/lib/postgresql/data
volumes:
  postgres16-data-1: {}
pod.yaml yaml
apiVersion: v1
kind: Pod
metadata:
  name: postgres16
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
  containers:
    - name: postgres16
      image: ghcr.io/northcutted/clearcutt/clearcutt-postgres16:v0.10.4-service
      ports:
        - containerPort: 5432
      volumeMounts:
        - { name: data-1, mountPath: /var/lib/postgresql/data }
  volumes:
    - { name: data-1, emptyDir: {} }
service-ops.sh shell
clearcutt service explain postgres16
clearcutt service validate postgres16
clearcutt service smoke postgres16 --engine docker --image ghcr.io/northcutted/clearcutt/clearcutt-postgres16:v0.10.4-service
service-provenance.sh shell
# Service package attr exposed by the ClearCutt flake.
nix build github:northcutted/clearcutt/v0.10.4#postgres16

# Catalog service records are emitted when generation includes services.
clearcutt catalog generate --config clearcutt.fleet.yaml --include-services --output dist/catalog
2

Verify & Audit Compliance

Inspect catalog evidence, run registry-side verification where evidence exists, and review vulnerability gates.

Provenance & signatures

Cryptographically audit OCI identity claims and supply chain gating artifacts.

raw in-toto JSONL

Cryptographic Proof

CATALOG REPORTS SIGNATURE
Signing Workflow release.yml
Workflow Ref refs/heads/main
OIDC Issuer token.actions.githubusercontent.com
OIDC Certificate Subject
https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main

Supply Chain Provenance

PROVENANCE RECORDED 3
Build Type GitHub Actions Workflow
Predicate Schema SLSA Provenance v1.0
Source Material github.com/northcutted/clearcutt
Commit SHA 0453258 ↗
Signed provenance record: Passed

Compilation & Tests

TESTS PASSED
Gating timestamp: 2026-06-09T02:38

Attestations

4 kinds of evidence for this image. The counts are how many times each was independently signed into the public transparency log — not how many distinct artifacts exist.

27 signed records
Subject ghcr.io/northcutted/clearcutt/clearcutt-postgres16 Digest sha256:7746ff36f6bc... index · amd64+arm64 Signed By release.yml @ main keyless ✓
Two ways to verify — pick the ecosystem you know
cosign · OCI Attestation lives with the image in the registry. Verify with cosign verify-attestation.
gh CLI · GitHub GitHub first-party attestation. Verify with gh attestation verify.

The subject above is the multi-arch index (amd64 + arm64). Each architecture's SBOM is attested separately, in both ecosystems — so one SBOM naturally appears as several signed records below. Records also accumulate as the image is rebuilt, with each release re-signing into the transparency log afresh. Every entry is independent and publicly verifiable: click any #index below to inspect it in Sigstore Rekor, or use the copy-paste commands below to verify them locally.

Build provenance slsa.dev/provenance/v1

How and where the image was built — binds this digest to the exact workflow run, commit, and builder.

signed
Verify with
Inspect Rekor log
SBOM spdx.dev/Document

Software Bill of Materials — the full inventory of packages baked into the image.

11× signed
Test results cosign.sigstore.dev/attestation/v1

Signed evidence that the release-gate test suite passed for this exact digest.

10× signed
Cosign signature sigstore.dev/cosign/sign/v1

The keyless cosign signature statement covering the image index.

signed
Verify with
Inspect Rekor log

Active Verification Toolkit

Run registry-side verification commands for the recorded release evidence.

Direct Cryptographic Evidence & Verification

Expected Certificate Subject https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main
Expected Certificate OIDC Issuer https://token.actions.githubusercontent.com
Manifest Index Digest sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974
One-step Audit Command

Run the native compiled Go CLI command locally to verify the registry digest, Sigstore signature, SBOM and test attestations, and SLSA provenance:

clearcutt verify release-evidence \
  --ref ghcr.io/northcutted/clearcutt/clearcutt-postgres16@sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974 \
  --repo northcutted/clearcutt \
  --workflow-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main'

1. Inspect Security Metadata

Query deep, high-fidelity security metadata, dynamic entrypoints, non-root user settings, architectures, and release asset URLs.

CATALOG_DIR=./path/to/catalog
clearcutt --catalog "$CATALOG_DIR" inspect postgres16 --tag v0.10.4

2. Local Policy Gate Verification

Check catalog-record evidence flags, smoke tests, vulnerability limits, and lifecycle constraints locally or in CI pipelines. Use the release-evidence command or the Cosign/SLSA tabs for registry-side cryptographic verification.

CATALOG_DIR=./path/to/catalog
clearcutt --catalog "$CATALOG_DIR" verify image postgres16 \
  --tag v0.10.4 \
  --require-production \
  --require-signature \
  --require-sbom \
  --require-provenance \
  --max-critical 0 \
  --max-high 5

3. Runtime Conformance Audit

Verify runtime specifications offline, asserting timezone configurations, dynamic links, CA certificate paths, and rootless isolation boundaries.

clearcutt conformance run \
  --expect-runtime service

4. Scaffold Nix Overlay Graft

Under strict corporate base OS mandates, generate a workspace scaffolding to graft this runtime overlay onto existing host layers.

clearcutt overlay generate \
  --runtime service16 \
  --tier service \
  --base registry.access.redhat.com/ubi9/ubi-minimal \
  --output my-service16-overlay/

1. Verify Keyless OIDC Signature

Confirm this OCI image was built in your official release workflow and signed via keyless OIDC certificates.

cosign verify ghcr.io/northcutted/clearcutt/clearcutt-postgres16@sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974 \
  --certificate-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --output json

2. Verify Cryptographic SBOM Attestation

Extract and cryptographically verify the compiled package software bill of materials statement.

cosign verify-attestation ghcr.io/northcutted/clearcutt/clearcutt-postgres16@sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974 \
  --type spdxjson \
  --certificate-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  | jq '.payload | @base64d | fromjson | .predicate'

slsa-verifier (SLSA Build L3)

Verify SLSA Build L3 provenance from the configured builder and source ref.

slsa-verifier verify-image ghcr.io/northcutted/clearcutt/clearcutt-postgres16@sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974 \
  --source-uri 'github.com/northcutted/clearcutt' \
  --source-branch 'main'

GitHub Native Attestation

Audit the GitHub-native provenance attestation using the GitHub CLI client.

gh attestation verify oci://ghcr.io/northcutted/clearcutt/clearcutt-postgres16@sha256:7746ff36f6bc400df5c6944aad622ec112468acebddb779951ea1d31e9f02974 \
  --repo northcutted/clearcutt \
  --cert-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --source-ref refs/heads/main
Loading vulnerability data...
3

Evidence & OCI Specifications

Inspect service SBOMs, image layers, OCI labels, and release history after reviewing the service contract above.

Software Bill of Materials

Every package included in the image's /nix/store closure. Generated from the actual OCI archive at build time and attached as an SPDX SBOM, using the same package inventory as the CVE findings above.

SBOM generated Tue, 09 Jun 2026 02:37:49 GMT. Toggle between architectures; the package set typically matches but layer hashes differ.

Loading SBOM data...
Loading layer data...

Image Specifications & Release Ledger

Inspect the static OCI container metadata labels and browse the immutable published release history for this image.

KeyValue
dev.clearcutt.image.kind service
dev.clearcutt.service.id postgres16
dev.clearcutt.service.template postgres
dev.clearcutt.service.version 16
org.opencontainers.image.authors ClearCutt maintainers
org.opencontainers.image.description Postgres database service image
org.opencontainers.image.licenses Apache-2.0
org.opencontainers.image.ref.name service
org.opencontainers.image.source https://github.com/northcutted/clearcutt
org.opencontainers.image.title clearcutt-postgres16
org.opencontainers.image.url https://github.com/northcutted/clearcutt
org.opencontainers.image.vendor ClearCutt
org.opencontainers.image.version 16
Tag Published Archs Packages
v0.14.0 latest Sat, 11 Jul 2026 00:47:46 GMT amd64arm64 37 .intoto.jsonl ↗
v0.13.0 Fri, 10 Jul 2026 00:21:20 GMT amd64arm64 37 .intoto.jsonl ↗
v0.12.2 Sat, 04 Jul 2026 17:29:57 GMT amd64arm64 37 .intoto.jsonl ↗
v0.12.1 Sat, 04 Jul 2026 13:08:58 GMT amd64arm64 37 .intoto.jsonl ↗
v0.11.1 Wed, 10 Jun 2026 02:52:21 GMT amd64arm64 37 .intoto.jsonl ↗
v0.11.0 Wed, 10 Jun 2026 01:24:14 GMT amd64arm64 37 .intoto.jsonl ↗
v0.10.4 Tue, 09 Jun 2026 12:54:17 GMT amd64arm64 37 .intoto.jsonl ↗
v0.10.2 Sun, 07 Jun 2026 21:31:16 GMT amd64arm64 37 .intoto.jsonl ↗
v0.10.1 Sun, 07 Jun 2026 16:42:20 GMT amd64arm64 37 .intoto.jsonl ↗
v0.10.0 Sun, 07 Jun 2026 14:37:59 GMT amd64arm64 37 .intoto.jsonl ↗