Base
Hardened build
minimal ports, security patches applied at build time
GUAC supply-chain security graph with GraphQL API and PostgreSQL 16 on Ubuntu 24.04 LTS
Azure
Security
GUAC, a supply chain security graph that ingests SBOM, SLSA and vulnerability documents and answers questions about your software through a GraphQL API and an interactive query playground.
Overview
GUAC (Graph for Understanding Artifact Composition) turns the scattered metadata about your software supply chain into a single connected graph you can query. It ingests the documents teams already produce, software bills of materials in CycloneDX or SPDX form, SLSA build attestations and vulnerability reports, and normalises them into a common model of packages, sources, builders and the dependencies between them. Instead of grepping across a pile of SBOM files, an engineer asks questions of the graph: which of our artifacts depend on this package, what version is running where, which builds are affected by a newly disclosed vulnerability. The graph is served over a GraphQL API with an interactive playground in the browser, so answers come back as structured data that can drive dashboards, policy checks and incident response. Documents are ingested with a simple command line collector, so a new SBOM becomes queryable within seconds, and the same model underpins everything from a single team asking about one application to a security function reasoning across an entire estate.
Why the cloudimg image
A supply chain graph is only trustworthy if the instance holding it is locked down, so cloudimg generates every secret on your own machine at first boot: the database password, the service database password and the web credential guarding the API are all created on the instance and written to a root only file, and none of them exists in the image. The GraphQL endpoint that accepts ingestion is never exposed unauthenticated: a host firewall closes every port except SSH and the web door, the database is bound to the loopback interface only, and the browser facing API sits behind per instance credentials. The published binaries are pinned by checksum and re-verified during the build, the image ships with a worked example already queryable so the graph is useful the moment it boots, and the build is checked before release to prove a real document genuinely ingests and comes back through a real query. Every deployment comes with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Ask which artifacts depend on a given package or are affected by a new vulnerability
- Aggregate SBOM, SLSA and vulnerability documents into one queryable supply chain graph
- Drive policy checks, dashboards and incident response from a GraphQL supply chain API
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
2F
2FAuth on Ubuntu 24.04 LTS
Security
2FAuth is a free, open source, self hosted web app for managing your two factor authentication accounts.
Ad
acme-dns on Ubuntu 24.04 LTS
Security
The image installs acme-dns 2.0.2 from the official upstream release (github.com/acme-dns/acme-dns, the project formerly...
addy.io on Ubuntu 24.04
Security
Mail sent to an alias is forwarded to your real inbox, and you can reply from the alias so the other side never learns w...
AliasVault on Ubuntu 24.04
Security
AliasVault is an open source, end to end encrypted password manager combined with a private email alias service that you...
Apache SpamAssassin
Security
This image runs Apache SpamAssassin, the long established open source anti spam platform, fully configured and security ...
Apache Syncope on Ubuntu 24.04
Security
Apache Syncope is an open source identity management and identity governance platform.