Image catalog
Image catalog
What's in the catalog, how images are organised, and how to find what you need.
Your PodArmor catalog is per-customer and lives in a customer-owned AWS account, so your internal CI can pull without a credential-swap dance. Images split along one axis:
- Build vs deploy. Build images are heavier — they contain Maven / Gradle / npm tooling, are intended for use as a
FROMin a multi-stage Dockerfile, and live in the CI pipeline. Deploy images are minimal runtime-only — distroless, non-root, no shell, no package manager.
Most customers have a mix of both per stack.
How to find an image
The portal's Images page lists every image you have access to, with the current CVE counts and pull commands inline. Each image has a detail page covering:
- Tag history (every published
-r{epoch}) - Outstanding patches vs Won't fix / Awaiting upstream split
- Side-by-side comparison against the upstream we replace
- Hardening attestation (non-root, no-shell, distroless, etc.)
- Full SBOM
- Per-CVE remediation status
Available image families
Your portal subdomain is the source of truth for the images you have access to.