Agent-ready Community Edition Images

Free open-source images with handbooks checked against the exact image, tested seed data, and a build kit that rebuilds the image offline. Built for engineers and their AI agents.

Rebuild it yourself: any release, with the network off, on your own builder and with your own signing key, to the identical digest we published. The SLSA Build Level 3 path

Browse the catalogue Buy a build kit
Community Edition only · Fully documented

The network is off.
The bytes still match.

Rebuild from the build kit with --network=none. A release counts below only when our latest clean-room rebuild reproduced the identical linux/amd64 image-manifest digest we published.

The ReadyStack robot, built out of shipping containers.
Rebuilt bit-for-bit
75 of 75
Rebuilt with the network off to the identical digest, latest 2026-10-24
Products
75
See the catalogue
Network during the rebuild
None
--network=none, nothing fetched
Agent-ready Build Kit
$500
One-time, per product; the image is free
Agent-ready Build Kit

Build SLSA 3 images on your own infrastructure.

Each build kit is the complete, pinned build of one release. Run it on your own hardened build platform, sign the SLSA v1 provenance BuildKit generates, and you reach SLSA Build Level 3 without engineering the build yourself. We are the shortcut; your platform supplies the hardening and the signing key.

$ ./BUILD_OFFLINE.sh --provenance
# --network=none · SLSA v1 provenance from BuildKit
$ ./VERIFY_OFFLINE.sh
==> DIGEST MATCH
# then sign the provenance with your own key

Defects our checks found

Open the defect log

What our checks found before release, counted from the public defect log, which says how each was found and what happened to it.

Defects found
9,112
across 75 products
Critical
704
688 fixed before release
Major
2,342
2,221 fixed before release
Minor
6,066
5,804 fixed before release
By category

What happened to them: 8,713 fixed before release · 61 fixed after release · 319 open, disclosed with their release · 19 not a defect (works as designed). Where they were: 9,037 in our build or documentation, 75 in the upstream project.

Don't trust us. Rebuild it yourself.

What a match looks like
# 1. the build kit is what we shipped
$ sha256sum -c CHECKSUMS.sha256
# 2. rebuild it with the network off, and compare
$ ./BUILD_OFFLINE.sh      # --network=none, nothing fetched
$ ./VERIFY_OFFLINE.sh
published : sha256:7e229b55c116501a7c00b78a1eba91ca…
rebuilt   : sha256:7e229b55c116501a7c00b78a1eba91ca…
==> DIGEST MATCH — reproduces the published image bit-for-bit.
# 3. the image is ours: signed, logged in the public Sigstore log
$ cosign verify --key https://readystack.dev/keys/cosign.pub readystack/<app>@sha256:…

How we count: a release counts only when our latest record shows it rebuilt from its build kit as sold, with the kit's own scripts and the network off, to the identical linux/amd64 digest. Each product page gives the date of that rebuild, or says it has not been re-verified.

What that takes

How the build works
  • Every basePinned by digest
  • Every timestampFrozen
  • The whole toolchainVendored
  • Left to varyNothing
  • Live Docker Hub tagAdd --online to prove it holds that digest

Docker Hub image

Free

Open source images, free to pull.

  • Community Edition (CE), open source only
  • Documented build process
  • Addressed by SHA-256 digest
  • Base OS named in every release tag
  • Each release's grade, with the date and why

Whether a release is signed, runs as non-root and carries SBOM and provenance attestations is shown per release on its product page, as read from the registry.

Browse on Docker Hub

Agent-ready Build Kit

Paid, per product

Everything to verify, rebuild, and operate.

The offline build, full documentation, seed data, validated tests, defect reports, and provenance records — per product.

Build
  • Dockerfile.offline
  • BUILD_RECIPE.json
  • CHECKSUMS.sha256
  • SBOM.json
  • VERIFY.md
  • REBUILD.md
  • bases/ pinned base images
  • vendored/ source
Documentation
  • Admin handbook
  • DB handbook
  • API guide
  • Seed data
  • Security report
  • Defects report
  • Validation tests
  • Release notes

The build kit holds the pinned base images and everything else the build needs, not the published image itself: you rebuild that from it, and VERIFY_OFFLINE.sh checks it matches.

$500 per product, one-timeBuy a build kit

What we promise, and what we don't

For auditors
  • Community Edition only, every release.
  • Every release signed with our published key and dated.
  • Every release on sale scanned every day; one that drops below grade A goes into the build queue the same day.
  • Every defect we find, logged in public with what happened to it.
  • No contractual CVE SLA yet. We measure the time from detection to a fixed release first, and will publish a target once the numbers support one.
  • linux/amd64 only. Every digest and rebuild we publish is for linux/amd64.
  • Not a compliance certificate. We supply evidence; your controls decide how you use it.

What ships in the Agent-ready Build Kit

Real excerpts from WordPress 7.1.2

Document preview