Skip to main content
View as Markdown

Quickstart

info

The English user guide is currently in beta preview. Most of the documents have been automatically translated from the Japanese version. Should you find any inaccuracies, please reach out to Flatt Security.

Takumi Images can be pulled and run by replacing an existing image reference with images.flatt.tech/takumi/<name>:latest. Pulling does not require authentication or account registration. For production deployments, do not rely on the mutable :latest tag alone; pin the image by digest and verify its signature.

info

Takumi Images is currently in beta. Specifications and behavior may change without prior notice.

Pull and run an image​

Takumi Images always use image names in the form images.flatt.tech/takumi/<name>. You can pull and run them like other container images.

docker pull images.flatt.tech/takumi/busybox:latest
docker run --rm images.flatt.tech/takumi/busybox:latest echo hello

Currently published container images are free to use. See the catalog for available images.

When there is an equivalent official or widely used image, each Takumi image keeps its invocation style aligned as much as possible. In many cases, the existing docker run <image> <args...> invocation works unchanged.

However, production images are distroless. They do not include a shell or package manager. Before replacing an image, confirm that your workload's startup command and arguments work as expected.

Pin by digest​

:latest is a continuously updated tag. To make deployment behavior stable, use a reference that includes the digest, not only the tag. If you want to keep automatic selection between amd64 and arm64, use the digest of the multi-arch index. The following example resolves the digest pointed to by a tag with crane.

IMAGE=images.flatt.tech/takumi/busybox:latest
DIGEST=$(crane digest "$IMAGE")
echo "${IMAGE}@${DIGEST}"
images.flatt.tech/takumi/busybox:latest@sha256:<digest>

This form keeps the latest label in the reference while pinning the actual content by digest. Even if :latest points to a different digest in the future, the deployed reference continues to point to the same image.

Verify the signature​

Each image is signed, so you can verify that the image you pulled was published by the official Takumi Images release workflow. Signatures are keyless and use GitHub Actions OIDC with the public Sigstore instance.

cosign verify \
  --certificate-oidc-issuer=https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'https://github.com/flatt-security/takumi-images/.github/workflows/release.yml@.*' \
  images.flatt.tech/takumi/busybox:latest

If verification succeeds, the image was published by the Takumi Images release workflow. The SBOM, SLSA Provenance, and VEX are signed with the same identity. See Attestation for their contents and verification steps.

Last updated on