Clearcutt Catalog
Reference Catalog
?
Service 8 · Service · valkey image

clearcutt-valkey8 : valkey

First-class valkey image with template-owned ports, storage, lifecycle, and smoke checks.

v0.11.1 amd64arm64 Status: preview Support: CURRENT Non-Prod Only Signature: Verified Provenance: Verified SBOM: Verified Vulnerability scan: Missing Tests: Verified Evidence overlays listed maintenance-stale
Multi-arch Manifest Digest:
sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b
Lifecycle Advisory: PREVIEW IMAGE

This image is currently in Preview status. It has catalog evidence, but is not recommended for production environments until general availability.

Published Wed, 10 Jun 2026 02:52:21 GMT

Last Rebuilt Wed, 10 Jun 2026 02:52:21 GMT

Scan data missing
1

Service Image Usage

Run the platform service, inspect its operational contract, and verify the evidence attached to this release.

Service Contract

valkey8 is a platform-owned service image. It is built from the fleet service template, cataloged separately from runtime tiers, and carries ports, storage, lifecycle, smoke, vulnerability, and evidence metadata.

Templatevalkey8
Lifecyclepreview / non-production
Portsredis:6379/tcp
Storage/data
Entrypoint/bin/valkey-server
Runtime UserUID 10001:10001
Smokeconfigured
Vulnerabilitiesscan pending

Configured Smoke Commands

  • valkey-server --version
  • valkey-cli --version

Pull & Run Service

Use digest-pinned pulls when available; mount volumes for stateful data dirs.

Pull by multi-arch digest

docker pull ghcr.io/northcutted/clearcutt/clearcutt-valkey8@sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b

Pinned service tag

docker pull ghcr.io/northcutted/clearcutt/clearcutt-valkey8:v0.11.1-service

Run service

docker run --rm \
  --user 10001:10001 \
  -p 6379:6379 \
  -v valkey8-data-1:/data \
  ghcr.io/northcutted/clearcutt/clearcutt-valkey8:v0.11.1-service

Pull by multi-arch digest

podman pull ghcr.io/northcutted/clearcutt/clearcutt-valkey8@sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b

Pinned service tag

podman pull ghcr.io/northcutted/clearcutt/clearcutt-valkey8:v0.11.1-service

Run service

podman run --rm \
  --user 10001:10001 \
  -p 6379:6379 \
  -v valkey8-data-1:/data \
  ghcr.io/northcutted/clearcutt/clearcutt-valkey8:v0.11.1-service
docker-compose.yml yaml
services:
  valkey8:
    image: ghcr.io/northcutted/clearcutt/clearcutt-valkey8:v0.11.1-service
    user: "10001:10001"
    ports:
      - "6379:6379"
    volumes:
      - valkey8-data-1:/data
volumes:
  valkey8-data-1: {}
pod.yaml yaml
apiVersion: v1
kind: Pod
metadata:
  name: valkey8
spec:
  automountServiceAccountToken: false
  securityContext:
    runAsNonRoot: true
    runAsUser: 10001
    runAsGroup: 10001
  containers:
    - name: valkey8
      image: ghcr.io/northcutted/clearcutt/clearcutt-valkey8:v0.11.1-service
      ports:
        - containerPort: 6379
      volumeMounts:
        - { name: data-1, mountPath: /data }
  volumes:
    - { name: data-1, emptyDir: {} }
service-ops.sh shell
clearcutt service explain valkey8
clearcutt service validate valkey8
clearcutt service smoke valkey8 --engine docker --image ghcr.io/northcutted/clearcutt/clearcutt-valkey8:v0.11.1-service
service-provenance.sh shell
# Service package attr exposed by the ClearCutt flake.
nix build github:northcutted/clearcutt/v0.11.1#valkey8

# Catalog service records are emitted when generation includes services.
clearcutt catalog generate --config clearcutt.fleet.yaml --include-services --output dist/catalog
2

Verify & Audit Compliance

Inspect catalog evidence, run registry-side verification where evidence exists, and review vulnerability gates.

Provenance & signatures

Cryptographically audit OCI identity claims and supply chain gating artifacts.

raw in-toto JSONL

Cryptographic Proof

CATALOG REPORTS SIGNATURE
Signing Workflow release.yml
Workflow Ref refs/heads/main
OIDC Issuer token.actions.githubusercontent.com
OIDC Certificate Subject
https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main

Supply Chain Provenance

PROVENANCE RECORDED 3
Build Type GitHub Actions Workflow
Predicate Schema SLSA Provenance v1.0
Source Material github.com/northcutted/clearcutt
Commit SHA 97ddb11 ↗
Signed provenance record: Passed

Compilation & Tests

TESTS PASSED
Gating timestamp: 2026-06-10T02:19

Attestations

4 kinds of evidence for this image. The counts are how many times each was independently signed into the public transparency log — not how many distinct artifacts exist.

12 signed records
Subject ghcr.io/northcutted/clearcutt/clearcutt-valkey8 Digest sha256:16c7fa35b1f9... index · amd64+arm64 Signed By release.yml @ main keyless ✓
Two ways to verify — pick the ecosystem you know
cosign · OCI Attestation lives with the image in the registry. Verify with cosign verify-attestation.
gh CLI · GitHub GitHub first-party attestation. Verify with gh attestation verify.

The subject above is the multi-arch index (amd64 + arm64). Each architecture's SBOM is attested separately, in both ecosystems — so one SBOM naturally appears as several signed records below. Records also accumulate as the image is rebuilt, with each release re-signing into the transparency log afresh. Every entry is independent and publicly verifiable: click any #index below to inspect it in Sigstore Rekor, or use the copy-paste commands below to verify them locally.

Build provenance slsa.dev/provenance/v1

How and where the image was built — binds this digest to the exact workflow run, commit, and builder.

signed
Verify with
Inspect Rekor log
SBOM spdx.dev/Document

Software Bill of Materials — the full inventory of packages baked into the image.

signed
Verify with
Inspect Rekor log
Test results cosign.sigstore.dev/attestation/v1

Signed evidence that the release-gate test suite passed for this exact digest.

signed
Verify with
Inspect Rekor log
Cosign signature sigstore.dev/cosign/sign/v1

The keyless cosign signature statement covering the image index.

signed
Verify with
Inspect Rekor log

Active Verification Toolkit

Run registry-side verification commands for the recorded release evidence.

Direct Cryptographic Evidence & Verification

Expected Certificate Subject https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main
Expected Certificate OIDC Issuer https://token.actions.githubusercontent.com
Manifest Index Digest sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b
One-step Audit Command

Run the native compiled Go CLI command locally to verify the registry digest, Sigstore signature, SBOM and test attestations, and SLSA provenance:

clearcutt verify release-evidence \
  --ref ghcr.io/northcutted/clearcutt/clearcutt-valkey8@sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b \
  --repo northcutted/clearcutt \
  --workflow-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main'

1. Inspect Security Metadata

Query deep, high-fidelity security metadata, dynamic entrypoints, non-root user settings, architectures, and release asset URLs.

CATALOG_DIR=./path/to/catalog
clearcutt --catalog "$CATALOG_DIR" inspect valkey8 --tag v0.11.1

2. Local Policy Gate Verification

Check catalog-record evidence flags, smoke tests, vulnerability limits, and lifecycle constraints locally or in CI pipelines. Use the release-evidence command or the Cosign/SLSA tabs for registry-side cryptographic verification.

CATALOG_DIR=./path/to/catalog
clearcutt --catalog "$CATALOG_DIR" verify image valkey8 \
  --tag v0.11.1 \
  --require-production \
  --require-signature \
  --require-sbom \
  --require-provenance \
  --max-critical 0 \
  --max-high 5

3. Runtime Conformance Audit

Verify runtime specifications offline, asserting timezone configurations, dynamic links, CA certificate paths, and rootless isolation boundaries.

clearcutt conformance run \
  --expect-runtime service

4. Scaffold Nix Overlay Graft

Under strict corporate base OS mandates, generate a workspace scaffolding to graft this runtime overlay onto existing host layers.

clearcutt overlay generate \
  --runtime service8 \
  --tier service \
  --base registry.access.redhat.com/ubi9/ubi-minimal \
  --output my-service8-overlay/

1. Verify Keyless OIDC Signature

Confirm this OCI image was built in your official release workflow and signed via keyless OIDC certificates.

cosign verify ghcr.io/northcutted/clearcutt/clearcutt-valkey8@sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b \
  --certificate-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  --output json

2. Verify Cryptographic SBOM Attestation

Extract and cryptographically verify the compiled package software bill of materials statement.

cosign verify-attestation ghcr.io/northcutted/clearcutt/clearcutt-valkey8@sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b \
  --type spdxjson \
  --certificate-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --certificate-oidc-issuer 'https://token.actions.githubusercontent.com' \
  | jq '.payload | @base64d | fromjson | .predicate'

slsa-verifier (SLSA Build L3)

Verify SLSA Build L3 provenance from the configured builder and source ref.

slsa-verifier verify-image ghcr.io/northcutted/clearcutt/clearcutt-valkey8@sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b \
  --source-uri 'github.com/northcutted/clearcutt' \
  --source-branch 'main'

GitHub Native Attestation

Audit the GitHub-native provenance attestation using the GitHub CLI client.

gh attestation verify oci://ghcr.io/northcutted/clearcutt/clearcutt-valkey8@sha256:16c7fa35b1f9c916430012530135721d609839304ab2cac52acf9fcc54fcc36b \
  --repo northcutted/clearcutt \
  --cert-identity 'https://github.com/northcutted/clearcutt/.github/workflows/release.yml@refs/heads/main' \
  --source-ref refs/heads/main
Loading vulnerability data...
3

Evidence & OCI Specifications

Inspect service SBOMs, image layers, OCI labels, and release history after reviewing the service contract above.

Software Bill of Materials

Every package included in the image's /nix/store closure. Generated from the actual OCI archive at build time and attached as an SPDX SBOM, using the same package inventory as the CVE findings above.

SBOM generated Wed, 10 Jun 2026 02:18:50 GMT. Toggle between architectures; the package set typically matches but layer hashes differ.

Loading SBOM data...
Loading layer data...

Image Specifications & Release Ledger

Inspect the static OCI container metadata labels and browse the immutable published release history for this image.

KeyValue
dev.clearcutt.image.kind service
dev.clearcutt.recipe.license Apache-2.0
dev.clearcutt.service.id valkey8
dev.clearcutt.service.template valkey
dev.clearcutt.service.version 8
org.opencontainers.image.authors ClearCutt maintainers
org.opencontainers.image.description Valkey in-memory data store service image
org.opencontainers.image.licenses NOASSERTION
org.opencontainers.image.ref.name service
org.opencontainers.image.source https://github.com/northcutted/clearcutt
org.opencontainers.image.title clearcutt-valkey8
org.opencontainers.image.url https://github.com/northcutted/clearcutt
org.opencontainers.image.vendor ClearCutt
org.opencontainers.image.version 8
Tag Published Archs Packages
v0.14.0 latest Sat, 11 Jul 2026 00:47:46 GMT amd64arm64 77 .intoto.jsonl ↗
v0.13.0 Fri, 10 Jul 2026 00:21:20 GMT amd64arm64 77 .intoto.jsonl ↗
v0.12.2 Sat, 04 Jul 2026 17:29:57 GMT amd64arm64 77 .intoto.jsonl ↗
v0.12.1 Sat, 04 Jul 2026 13:08:58 GMT amd64arm64 77 .intoto.jsonl ↗
v0.11.1 Wed, 10 Jun 2026 02:52:21 GMT amd64arm64 77 .intoto.jsonl ↗
v0.11.0 Wed, 10 Jun 2026 01:24:14 GMT amd64arm64 77 .intoto.jsonl ↗
v0.10.4 Tue, 09 Jun 2026 12:54:17 GMT amd64arm64 77 .intoto.jsonl ↗
v0.10.2 Sun, 07 Jun 2026 21:31:16 GMT amd64arm64 77 .intoto.jsonl ↗
v0.10.1 Sun, 07 Jun 2026 16:42:20 GMT amd64arm64 77 .intoto.jsonl ↗
v0.10.0 Sun, 07 Jun 2026 14:37:59 GMT amd64arm64 77 .intoto.jsonl ↗