Hardened pgAdmin images

Both variants package the same pgAdmin release and run without any Linux capability, so they fit OpenShift's restricted profile and an arbitrary UID. They differ in how much of the official image they keep.

• Hardened (<version>-hardened, latest). pgAdmin rebuilt from its release source on fresh Python and Alpine bases, with every OS package upgraded and Python dependencies re-resolved. Postfix, sudo, libcap and every setuid binary are left out. It is rebuilt whenever an input changes, and at least once a week, so fixes reach it without waiting for the next pgAdmin release.
• Upstream-compatible (<version>). The official image with only its capability-bearing Python copy removed. It is published once and never rebuilt, so its findings grow with time; it is here for those who need the official image's behaviour exactly.
• Checked before it ships. Every change is built and checked for those properties before it is merged, and the publish runs the same checks again before any tag moves. A change that introduces a critical finding with an available fix is blocked.
• Measured, not claimed. Each published image comes with its SBOM and a cosign signature, and the comparison below is regenerated every night from public data, with every remaining finding listed.

docker pull ghcr.io/fyannk/pgadmin:latest

• Same inventory tool on both sides. The same Syft, at the version shown above, inventories our images and dpage/pgadmin4 each night, the official image pulled through mirror.gcr.io, Google's mirror of Docker Hub, which serves the same digests. The SBOM attached to each image at build time is published below as it ships, but not counted from: it comes from another Syft, which counts some packages differently. Only linux/amd64 is compared, the platform published here.
• Two scanners. grype scans those SBOMs, including the Go standard library compiled into any Go binary (grype's default skips that). Trivy scans the images themselves. They use different vulnerability databases and severity sources, so their counts differ; the gap between ours and the official image is what to compare. The build time of each scanner's advisory database is shown at the top of the page, and flagged when it is more than two days older than the scan.
• "With a fix" means a fixed version of the affected package exists. Some of those cannot be applied here: a fix only in a Python pre-release, or one outside a version pgAdmin pins. The rest are waiting on Alpine, Python or the upstream projects, for ours and the official image alike.
• Same release. Each row compares the same pgAdmin release. The images are built at different times, so OS and Python package versions differ between them; that difference is the point of the hardened variant.
• Counts are one per advisory and package, per image.

The raw data is public: latest summary, history, and, for each variant, every finding and the SBOM of the published image, linked from the tags table above.