Hardened, scanned virtual machine images for the sogeor platform.
- Builds Proxmox VE templates with Packer:
ubuntu-2404-baseandubuntu-2404-k8s. - Secure by default: no passwords, SSH keys only, ephemeral build key, identity reset on clone.
- Verified every build: goss checks, OpenSCAP CIS Level 1 Server report, Trivy scan and CycloneDX SBOM.
- Kubernetes-ready: containerd 2.x, kubeadm/kubelet/kubectl held, control plane images pre-pulled.
- Automated lifecycle: monthly rebuilds, clone verification, pruning of old templates, Renovate updates.
- Talos Linux: Image Factory schematic as code with published image URLs and a Proxmox VE template for Cluster API.
flowchart LR
GH[GitHub Actions<br/>build workflow] -->|WireGuard| PVE[Proxmox VE]
PVE --> B[ubuntu-2404-base]
B -->|full clone| K[ubuntu-2404-k8s]
B & K --> V[verify clone]
B & K -.-> R[(goss · OpenSCAP · Trivy · SBOM)]
V --> P[prune: keep 3 newest]
git clone https://github.com/sogeor/images.git && cd images
tools/packer.sh init ubuntu-2404-base
tools/packer.sh validate ubuntu-2404-base --syntax-only
PKR_VAR_build_version="$(date +%Y%m%d)-0" tools/packer.sh build ubuntu-2404-baseRequires Packer, Python and a Proxmox VE API token: see Getting started.
| Page | What is inside |
|---|---|
| Overview | Purpose, outputs, place in the platform |
| Getting started | From zero to the first verified template |
| Repository setup | GitHub settings, Proxmox token, CI network, Environment, Renovate, Scorecard |
| Configuration | Every variable, environment variable, workflow input and secret |
| Usage | Builds, verification, template lookup, reports, Talos |
| Operations | Monthly rebuild, updates, rollback, pruning, credential rotation, new OS |
| Architecture | Components, pipeline, network, lifecycle, contract |
| Security | Guarantees, limits, assurance case |
| Troubleshooting | Symptoms, causes and fixes |
| Reference | Workflows, scripts, names and tags |
| Decisions | Architecture decision records |
Preview locally: pip install --require-hashes -r .github/requirements-docs.txt && mkdocs serve.
| OS | Proxmox VE | OpenStack (Selectel, VK Cloud) | Yandex Cloud | Status |
|---|---|---|---|---|
| Ubuntu Server 24.04 LTS | base, k8s | planned | planned | stable |
| Ubuntu Server 26.04 LTS | planned | planned | planned | planned |
| Astra Linux SE 1.8 | planned | — | — | planned |
| Alpine Linux | planned | planned | — | experimental |
| Talos Linux | Image Factory; template base for Cluster API |
Image Factory (Glance image planned) | Image Factory | stable |
| Component | Version |
|---|---|
| Packer | 1.16.1 |
hashicorp/proxmox |
1.2.4 |
hashicorp/ansible |
1.1.6 |
| Ubuntu Server | 24.04.5 LTS |
| ansible-core (CI) | 2.21.5 |
| Kubernetes | 1.37.1 (1.37.1-1.1, pkgs.k8s.io) |
| containerd | ≥ 2.0, Ubuntu noble-updates |
ansible.posix |
2.2.2 |
| goss | 0.4.9 |
| Trivy | 0.75.0 |
| SCAP Security Guide | 0.1.82 |
| Talos Linux | 1.14.2 |
sogeor/workflows (packer-build, docs, scorecard, export-env, setup-mesh) |
v0.1.1 |
| actions/checkout | v7.0.1 |
| hashicorp/setup-packer | v3.4.0 |
| markdownlint-cli2 (pre-commit) | 0.23.3 |
| mkdocs-material | 9.7.7 |
| actionlint | 1.7.12 |
| gitleaks | 8.30.1 |
| zizmor | 1.30.1 |
| yamllint | 1.38.0 |
| ansible-lint | 26.9.0 |
| shellcheck | 0.11.0 |
Python tools are locked with hashes (*.in → *.txt by pip-compile, header kept for Renovate): tools/requirements-ci.txt,
.github/requirements-lint.txt, .github/requirements-docs.txt. Regeneration: Operations.
See CONTRIBUTING.md. Governance: GOVERNANCE.md. Plans: ROADMAP.md. Conduct: CODE_OF_CONDUCT.md. Changes: CHANGELOG.md.
Report vulnerabilities privately as described in SECURITY.md. What the images guarantee: docs/security.md.