Skip to content

Commit 0dbbac0

Browse files
docs: add documentation for dockerhub (#2063)
* docs: add documentation for dockerhub Signed-off-by: Ludovic Ortega <[email protected]> * docs: typo fixes --------- Signed-off-by: Ludovic Ortega <[email protected]> Co-authored-by: sudo-kraken <[email protected]>
1 parent 81eab74 commit 0dbbac0

File tree

2 files changed

+37
-28
lines changed

2 files changed

+37
-28
lines changed

docs/getting-started/docker.mdx

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,10 @@ Details on how to install Docker can be found on the [official Docker website](h
1111
Refer to [Configuring Databases](/extending-jellyseerr/database-config#postgresql-options) for details on how to configure your database.
1212
:::
1313

14+
:::info
15+
An alternative Docker image is available on Docker Hub for this project. You can find it at [Docker Hub Repository Link](https://hub.docker.com/r/seerr/seerr)
16+
:::
17+
1418
## Unix (Linux, macOS)
1519
:::warning
1620
Be sure to replace `/path/to/appdata/config` in the below examples with a valid host directory path. If this volume mount is not configured correctly, your Jellyseerr settings/data will not be persisted when the container is recreated (e.g., when updating the image or rebooting your machine).
@@ -71,7 +75,7 @@ docker run -d ...
7175
:::info
7276
All official Seerr images are cryptographically signed and include a verified [Software Bill of Materials (SBOM)](https://cyclonedx.org/).
7377

74-
To confirm that the container image you are using is authentic and unmodified, please refer to the [Verifying Signed Images](/using-jellyseerr/advanced/verifying-signed-images) guide.
78+
To confirm that the container image you are using is authentic and unmodified, please refer to the [Verifying Signed Artifacts](/using-jellyseerr/advanced/verifying-signed-artifacts) guide.
7579
:::
7680

7781
:::tip

docs/using-jellyseerr/advanced/verifying-signed-images.mdx renamed to docs/using-jellyseerr/advanced/verifying-signed-artifacts.mdx

Lines changed: 32 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,21 @@
11
---
2-
id: verifying-signed-images
3-
title: Verifying Signed Images
4-
sidebar_label: Verify Signed Images
5-
description: Learn how to verify Seerr's signed container images and SBOM attestations using Cosign, Docker, Podman, or Skopeo.
2+
id: verifying-signed-artifacts
3+
title: Verifying Signed Artifacts
4+
sidebar_label: Verify Signed Artifacts
5+
description: Learn how to verify Seerr's signed artifacts and SBOM attestations.
66
---
77

88
import Tabs from '@theme/Tabs';
99
import TabItem from '@theme/TabItem';
1010

11-
# Verifying Signed Images
11+
# Verifying Signed Artifacts
12+
13+
These artifacts are cryptographically signed using [Sigstore Cosign](https://docs.sigstore.dev/quickstart/quickstart-cosign/):
14+
- Container images
1215

13-
All Seerr container images published to GitHub Container Registry (GHCR) are cryptographically signed using [Sigstore Cosign](https://docs.sigstore.dev/quickstart/quickstart-cosign/).
1416
This ensures that the images you pull are authentic, tamper-proof, and built by the official Seerr release pipeline.
1517

16-
Each image also includes a CycloneDX SBOM (Software Bill of Materials) attestation, generated with [Trivy](https://aquasecurity.github.io/trivy/), providing transparency about all dependencies included in the image.
18+
Additionally each container image also includes a CycloneDX SBOM (Software Bill of Materials) attestation, generated with [Trivy](https://aquasecurity.github.io/trivy/), providing transparency about all dependencies included in the image.
1719

1820
---
1921

@@ -22,37 +24,40 @@ Each image also includes a CycloneDX SBOM (Software Bill of Materials) attestati
2224
You will need the following tools installed:
2325

2426
- [Cosign](https://docs.sigstore.dev/cosign/system_config/installation/)
27+
28+
To verify images:
29+
2530
- [Docker](https://docs.docker.com/get-docker/) **or**
2631
- [Podman](https://podman.io/getting-started/installation) (including [Skopeo](https://github.com/containers/skopeo/blob/main/install.md))
2732

28-
```bash
29-
cosign version
30-
```
33+
---
3134

32-
If using **Podman**, ensure `skopeo` is available:
35+
# Verifying Signed Images
3336

34-
```bash
35-
skopeo --version
36-
```
37+
All Seerr container images published to GitHub Container Registry (GHCR) are cryptographically signed using [Sigstore Cosign](https://docs.sigstore.dev/quickstart/quickstart-cosign/).
38+
This ensures that the images you pull are authentic, tamper-proof, and built by the official Seerr release pipeline.
39+
40+
Each image also includes a CycloneDX SBOM (Software Bill of Materials) attestation, generated with [Trivy](https://aquasecurity.github.io/trivy/), providing transparency about all dependencies included in the image.
3741

3842
---
3943

40-
## Image Locations
44+
### Image Locations
4145

4246
Official Seerr images are available from:
4347

4448
- GitHub Container Registry (GHCR): `ghcr.io/seerr-team/seerr:<tag>`
49+
- Docker Hub: `seerr/seerr:<tag>`
4550

4651
You can view all available tags on the [Seerr Releases page](https://github.com/seerr-team/seerr/releases).
4752

4853
---
4954

50-
## Verifying a Specific Release Tag
55+
### Verifying a Specific Release Tag
5156

5257
Each tagged release (for example `v2.7.4`) is immutable and cryptographically signed.
5358
Verification should always be performed using the image digest (SHA256).
5459

55-
### Retrieve the Image Digest
60+
#### Retrieve the Image Digest
5661

5762
<Tabs groupId="verify-methods">
5863
<TabItem value="docker" label="Docker">
@@ -78,7 +83,7 @@ sha256:abcd1234...
7883

7984
---
8085

81-
### Verify the Image Signature
86+
#### Verify the Image Signature
8287

8388
<Tabs groupId="registry-methods">
8489
<TabItem value="ghcr" label="GitHub Container Registry (GHCR)">
@@ -112,14 +117,14 @@ The following checks were performed:
112117

113118
---
114119

115-
## Verifying the `latest` Tag
120+
### Verifying the `latest` Tag
116121

117122
:::warning Latest Tag Warning
118123
The `latest` tag is **mutable**, meaning it will change with each new release.
119124
Always verify the digest that `latest` currently points to.
120125
:::
121126

122-
### Retrieve the Digest for `latest`
127+
#### Retrieve the Digest for `latest`
123128

124129
<Tabs groupId="verify-methods">
125130
<TabItem value="docker" label="Docker">
@@ -143,7 +148,7 @@ Example output:
143148
sha256:abcd1234...
144149
```
145150

146-
### Verify the Signature
151+
#### Verify the Signature
147152

148153
<Tabs groupId="registry-methods">
149154
<TabItem value="ghcr" label="GHCR">
@@ -171,11 +176,11 @@ The wildcard `v.*` ensures verification works for any versioned release that `la
171176

172177
---
173178

174-
## Verifying SBOM Attestations
179+
### Verifying SBOM Attestations
175180

176181
Each image includes a CycloneDX SBOM attestation.
177182

178-
### Verify the Attestation
183+
#### Verify the Attestation
179184

180185
```bash
181186
cosign verify-attestation ghcr.io/seerr-team/seerr@sha256:abcd1234... \
@@ -193,7 +198,7 @@ The following checks were performed:
193198
- Certificate issued by Fulcio to the expected workflow identity
194199
:::
195200

196-
### Extract the SBOM for Inspection
201+
#### Extract the SBOM for Inspection
197202

198203
```bash
199204
cosign verify-attestation ghcr.io/seerr-team/seerr@sha256:abcd1234... \
@@ -206,7 +211,7 @@ You can open `sbom.json` in a CycloneDX viewer or analyse it with [Trivy](https:
206211

207212
---
208213

209-
## Expected Certificate Identity
214+
### Expected Certificate Identity
210215

211216
The expected certificate identity for all signed Seerr images is:
212217

@@ -222,7 +227,7 @@ This confirms that the image was:
222227

223228
---
224229

225-
## Troubleshooting
230+
### Troubleshooting
226231

227232
| Issue | Likely Cause | Suggested Fix |
228233
|-------|---------------|----------------|
@@ -233,7 +238,7 @@ This confirms that the image was:
233238

234239
---
235240

236-
## Example: Full Verification Flow
241+
### Example: Full Verification Flow
237242

238243
<Tabs groupId="verify-examples">
239244
<TabItem value="docker" label="Docker">

0 commit comments

Comments
 (0)