truebyteinnovationllp/grafana repository overview

⁠Grafana — Hardened, Source-Built Image

Minimal, security-hardened Grafana OSS — built entirely from source on Alpine Linux. A four-stage build clones the pinned upstream commit, compiles the Node 24 frontend, cross-compiles the Go 1.26 backend for every target architecture, and ships a lean non-root runtime image.

⁠Why this image?

⁠Tags

⁠Quick start

docker run -d --name grafana \
  -p 3000:3000 \
  -v grafana-data:/var/lib/grafana \
  truebyteinnovationllp/grafana:13.0.2

Open http://localhost:3000⁠ and log in with admin / admin (you will be prompted to change the password). Check health:

curl -s http://localhost:3000/api/health
# {"commit":"3fcdbc5a","database":"ok","version":"13.0.2"}

⁠Hardened deployment

Run with a read-only root filesystem — only the data volume needs to be writable:

docker run -d --name grafana \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges \
  -p 3000:3000 \
  -v grafana-data:/var/lib/grafana \
  --tmpfs /tmp \
  truebyteinnovationllp/grafana:13.0.2

⁠Configuration

Configure via GF_<SECTION>_<KEY> environment variables, or mount your own config:

docker run -d --name grafana \
  -p 3000:3000 \
  -e GF_SECURITY_ADMIN_PASSWORD='<strong-password>' \
  -e GF_SERVER_ROOT_URL='https://grafana.example.com' \
  -v grafana-data:/var/lib/grafana \
  truebyteinnovationllp/grafana:13.0.2

Common environment variables:

See the Grafana configuration reference⁠ for the full list.

⁠Verifying the signature

The image is signed with Cosign⁠. The public key is published at:

https://gitlab.truebyteinnovation.com/internal-docker/docker-images/-/raw/main/assets/cosign.pub

# Download the public key
curl -sSfL https://gitlab.truebyteinnovation.com/internal-docker/docker-images/-/raw/main/assets/cosign.pub \
  -o cosign.pub

# Verify
cosign verify --key cosign.pub truebyteinnovationllp/grafana:13.0.2

⁠Vulnerability status

This image is scanned with Trivy and Docker Scout on every build. CVEs suppressed via OpenVEX (grafana.openvex.json):

All four suppressions match the Docker Hardened Images (DHI) vulnerability profile for Grafana 13.0.2.

⁠Build resources

The frontend build requires ~6 GB RAM for webpack/rspack. Total build time is 15–30 minutes depending on hardware (builders run natively on $BUILDPLATFORM; Go cross-compiles without QEMU). The Node modules and Go module cache stay in throwaway builder stages and do not land in the final image.

⁠Source

• Image source: https://gitlab.truebyteinnovation.com/internal-docker/docker-images⁠
• Upstream: https://github.com/grafana/grafana⁠
• License: AGPL-3.0-only⁠

Maintained by TrueByte Innovation⁠.