Base
Hardened build
minimal ports, security patches applied at build time
SignServer Community Edition on Ubuntu 24.04 LTS
Azure
Security
SignServer, an open source server that signs documents, code and data and issues trusted timestamps, keeping your signing keys in one audited place.
Overview
SignServer is a server side digital signature application. Instead of scattering private keys across laptops and build machines, applications call SignServer over a simple HTTP and REST interface and it performs the signing centrally, so keys stay on the server behind a controlled, auditable service. Signing operations are configured as workers: a PDF signer, an XML signer, a generic CMS or plain data signer, and an RFC 3161 time stamp authority for trusted timestamping, each with its own key and access rules.
It suits teams that need to sign PDFs and XML documents, sign code and software artifacts, run an internal time stamp authority, or expose signing as a shared service to other systems, while keeping a single point of control over the keys and a record of how they are used. Administrators manage keys and workers through a web administration console; developers and applications submit data to be signed over the process and REST endpoints and receive the signature back.
Why the cloudimg image
cloudimg delivers SignServer as a complete, secure by default appliance: the pinned upstream Community Edition server runs the moment the instance boots, backed by a self contained local database, with no container registry to reach or configuration to assemble by hand. It is secure by default: no administrator is baked into the image, and on the first boot of every instance a unique administration certificate and its keystore password are generated and written to a root only file, so the web administration console is reachable only with that per VM credential and no two instances ever share a secret. A sample signer is configured on first boot so you can verify signing immediately, the database is captured empty and re provisioned per instance, the server learns its own public address on every boot, the base is fully patched with unattended security upgrades enabled, and every deployment comes with a paired deploy guide and 24/7 cloudimg support.
Common uses
- Centralize PDF, XML and CMS document signing behind one signing service
- Sign code and software artifacts and issue trusted RFC 3161 timestamps
- Keep signing keys on the server and call them over a REST and HTTP API
See it running
Real screenshots taken while testing this image against its deployment guide.
More in Security
KeePass Password Manager
Security
KeePass is a free, open source password manager that stores all your passwords in a highly encrypted database. The datab...
CrowdSec
Security
This image runs CrowdSec, the free and open source collaborative behavioural security engine.
Ollama GPU-Accelerated LLM Server
Security
This image runs Ollama 0.30, the easiest way to run open large language models locally - pull and serve Llama, Mistral, ...
OWASP ZAP
Security
This image runs OWASP ZAP (the Zed Attack Proxy), the world's most widely used open source web-application security scan...
step-ca
Security
This image runs step-ca, the open source online certificate authority from Smallstep for secure, automated X.509 and ACM...
Trivy Security Scanner
Security
This image runs Trivy, the open source, Apache-2.0 licensed all-in-one security scanner from Aqua Security.