Takumi Images

info

The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.

Takumi Images provides container images that are continuously maintained so they can stay free of known vulnerabilities. It is one of the Takumi byGMO features, alongside Assessment, Takumi Runner, and Takumi Guard.

Images are published at the OCI registry images.flatt.tech.

info

Takumi Images is currently in beta. Specifications and behavior may change without prior notice.

Background

The number of publicly disclosed CVEs continues to increase each year. According to the NVD Dashboard, more than 40,000 CVEs were published in 2024.

One factor behind this growth is the emergence of high-capability AI models, often called frontier AI. AI can make defensive code analysis and vulnerability research more efficient, but it can also accelerate vulnerability discovery and shorten the time from disclosure to exploitation. Japan's Financial Services Agency and the Bank of Japan have asked financial institutions to respond to this change, including by adding resources for patch management (request regarding short-term responses to threat changes caused by frontier AI). Development organizations need to patch more continuously and more frequently than before.

At the same time, software supply-chain attacks increasingly target the update process itself. In March 2026, the widely used axios library was tampered with, compromising users through an update operation. Similar attacks have continued since then.

Organizations face two conflicting pressures: delaying updates leaves vulnerabilities in place, while rushing updates can expose them to supply-chain attacks. Takumi Images is designed to reduce both pressures at once: frequent patching demand and the risk introduced by updating.

Migration and updates

If the catalog contains an image corresponding to the base image you use, migration often only requires changing the FROM line in your Dockerfile. You can move to a base image with known vulnerabilities addressed without significantly changing your existing build pipeline or development workflow.

- FROM node:latest
+ FROM images.flatt.tech/takumi/node:latest

After migrating, when new vulnerabilities are disclosed, you can use the patched image by pulling the latest image again. You do not need to investigate dependency packages or select fixed versions yourself.

Current scope

Beta

Takumi Images is in beta. See the catalog for the current list of published images. The currently published tag is :latest. :latest supports both amd64 and arm64.

Version-specific tags and vulnerability response SLAs are defined as planned capabilities, but are not yet provided. See Pricing & Billing for details.

Benefits

Switching your base image to Takumi Images gives you the following benefits.

• Your base image is less likely to contain known vulnerabilities. Takumi Images include only the main program and the minimal runtime libraries needed to execute it. This greatly reduces scanner noise that comes from the base image rather than from your application code.

• The provider triages vulnerabilities in the base image. When a vulnerability is detected in software included in Takumi Images, the provider evaluates its impact and exploitability and publishes that decision in VEX format. Users do not need to triage base-image vulnerability findings themselves.

• You can verify the image supply chain. Each image is accompanied by a signature, SBOM, and SLSA Provenance, so you can verify its contents and origin with standard tools.

• You can use images in a form close to existing invocations. When there is a widely used equivalent image, the invocation style is kept broadly aligned with it. In many cases, docker run <image> <args...> works as before.