Flareo re-publishes pinned upstream images with receipts — SBOM, scan, Sigstore signature — so you can check the bits yourself. A curated catalog, and a compose file you take home. We do not build from Dockerfiles.
Seven steps — pin, copy, SBOM, scan, sign, catalog, verify. Same frozen Vaultwarden run every time.
Sign in to start →Live cosign check against public Sigstore infrastructure. Catalog images get full scan enrichment.
Sign in to verify →Module listings, trust scores, and takeaway compose files are public. No account required.
Browse catalog →Signed release binaries will be published once the release workflow runs. Until then, build from source.
Anyone can push anything. :latest tags mutate under you. Publisher identity isn't cryptographically bound to images. One compromised maintainer account and your prod is running a trojan you can't detect.
What's actually inside that container? Which commit built it? What dependencies were pulled at build time? Standard registries give you none of this. You're trusting a community reputation score at best.
Railway, Render, Fly.io are convenient until they raise prices, change limits, or go dark. Your deployment's SLA is theirs. Migration is painful. For homelab operators this is a non-starter.
Cosign + Trivy + Syft + SLSA generator + Rekor integration takes a platform team at least a quarter to ship reliably. For everyone below that scale, supply-chain security stays aspirational.
Two real shell sessions. Same end state — a running Uptime Kuma instance on a self-hosted box. Different paths to get there. The time stamps on the left are real; we kept the log honest.
19:42 $ docker search uptime-kuma
NAME STARS OFFICIAL
louislam/uptime-kuma 7842 [no]
louislam/uptime-kuma2 12 [no]
linuxserver/uptime-kuma 0 [no]
19:43 # ok — louislam looks legit. let me read the readme.
19:43 $ open https://hub.docker.com/r/louislam/uptime-kuma
19:51 # readme says "use docker compose". where's the compose file?
# not in the readme. linked to a github repo. switch tabs.
19:54 $ open https://github.com/louislam/uptime-kuma
20:02 # found a docker-compose.yml in /docker. wonder if it's current?
# 8 months since last commit on it. let me copy it anyway.
20:04 $ wget https://raw.githubusercontent.com/.../docker-compose.yml
20:04 $ cat docker-compose.yml
version: '3.3'
services:
uptime-kuma:
image: louislam/uptime-kuma:latest ← :latest? in production?
container_name: uptime-kuma
volumes:
- ./uptime-kuma-data:/app/data
ports:
- 3001:3001 ← what about TLS?
restart: always
20:09 # let me at least pin the digest. what's the actual digest?
20:09 $ docker pull louislam/uptime-kuma:latest
latest: Pulling from louislam/uptime-kuma
Digest: sha256:f4c8e2...
20:11 # is :latest signed? cosign verify expects an identity...
20:11 $ cosign verify louislam/uptime-kuma:latest
Error: no matching signatures found
20:12 # ok. unsigned. trivy at least?
20:12 $ trivy image louislam/uptime-kuma:latest
─ alpine 3.18 ─
Total: 14 (CRITICAL: 0, HIGH: 3, MEDIUM: 8, LOW: 3)
20:18 # 3 highs. acceptable? maybe? upstream hasn't shipped patches.
# i'm out of patience. shipping it anyway.
20:24 $ docker compose up -d
20:25 $ curl -fsS http://localhost:3001/
<!DOCTYPE html>... ✓ alive
20:29 # took 47 minutes. unsigned image. unknown SBOM.
# back to fighting Caddy for TLS. monday-me's problem.
19:42 # open flareo.app/marketplace, search "uptime kuma"
# see: trust 94 · signed provenance · 0 critical · 8 reviews · 4.6★
# click "try shared demo" — see real instance on flareo subdomain
19:43 # works. exactly the dashboard i wanted. close tab.
19:44 # back to the module page. click "DOWNLOAD .md BUNDLE"
19:44 $ curl -O https://flareo.app/api/v1/modules/uptime-kuma/takeaway
19:44 $ ls
uptime-kuma-1.23.4-takeaway.md
19:45 # extract the compose file from the .md and verify before pulling
19:45 $ flareo takeaway uptime-kuma --extract compose > docker-compose.yaml
19:45 # cosign verify command is in the README at the top of the bundle
19:45 $ cosign verify ghcr.io/flareo/uptime-kuma@sha256:9a8b... \
--certificate-identity 'https://github.com/Yolo1105/flareo/...' \
--certificate-oidc-issuer 'https://token.actions.githubusercontent.com'
Verification for ghcr.io/flareo/uptime-kuma --
✓ The cosign claims were validated
✓ Existence of the claims in the transparency log was verified
✓ The code-signing certificate was verified
19:46 $ docker compose up -d
19:46 $ curl -fsS http://localhost:3001/
<!DOCTYPE html>... ✓ alive
19:46 # done. signed. SBOM bundled. provenance attested. 4 minutes.
# tuesday-me thanks monday-me. this is the new normal.
# Generated by flareo 0.4.2 · 2026-04-21T14:05:14Z
# Module: vaultwarden@1.30.5 · signed provenance · 0 CVEs
# Verify: cosign verify ghcr.io/flareo/vaultwarden@sha256:9a8b7c6d5e4f
version: "3.9"
services:
vaultwarden:
image: ghcr.io/flareo/vaultwarden@sha256:9a8b7c6d5e4f3a2b
container_name: vaultwarden
restart: unless-stopped
environment:
DOMAIN: "https://vault.example.com"
SIGNUPS_ALLOWED: "false"
WEBSOCKET_ENABLED: "true"
ports:
- "8080:80"
- "3012:3012"
volumes:
- ./vw-data:/data
labels:
flareo.module: vaultwarden
flareo.version: "1.30.5"
flareo.provenance: signed
flareo.verified-at: "2026-04-20T14:05:14Z"