Skip to content

Container assurance dashboard

Dashboard presentation and report generation live in the separate private GitLab project indianhilllabs/container-assurance-dashboard. This secure-containers repository remains the authoritative producer of build, test, SBOM, vulnerability, policy, runtime, and STIG gap evidence.

Evidence handoff

export:assurance-evidence validates that the current reports agree on source revision and immutable image digests. It then:

  • records the exact source project, pipeline, export job, ref, and revision;
  • copies the GitLab Requirement mapping into the evidence bundle;
  • hashes and manifests every dashboard input;
  • uploads the Requirement results to this project's GitLab Requirements view; and
  • exposes only non-secret lineage variables to the downstream trigger.

The manifested artifact includes the per-image Ubuntu userspace assessment, complete 194-rule Ubuntu 24.04 V1R6 applicability reports, and all three additive assurance-level decisions. The export validator rejects mismatched digests, source revisions, assurance policy hashes, and any higher qualified level whose predecessor did not qualify. The downstream artifact verifier remains bound to the exact export job and each manifested file's SHA-256; presentation can evolve without weakening that boundary.

trigger:assurance-dashboard starts the dashboard project's main pipeline. The downstream pipeline downloads the exact export job artifact through GitLab's job-artifact API and verifies the manifest before normalizing or publishing data. The source project's CI job token scope must allow only the dashboard project to read these artifacts.

The downstream trigger is intentionally not a container promotion control. Dashboard availability is operationally important, but the security decision is based on the validated source evidence. Lab promotion therefore requires ASSURANCE_EVIDENCE_VALID=true, not a successful presentation deployment.

Detailed views and reports

The dashboard owns detailed views for:

  1. overview and promotion posture;
  2. vulnerability findings and remediation state;
  3. SBOM components, suppliers, ecosystems, and license expressions;
  4. selected STIG gap controls, GitLab Requirement results, and remediation actions;
  5. runtime observations and explicit assertion boundaries;
  6. evidence catalog and cross-project pipeline lineage; and
  7. report exports.

Reports are deliberately last. Available exports include an executive Markdown summary, finding-, component-, license-, control-, and evidence-level CSV files, GitLab Requirement results JSON, the normalized assurance data JSON, and a print stylesheet for PDF output.

Access and assessment boundary

Both projects and the dashboard Pages site must remain private to project members. The normalized browser payload excludes credentials, raw scanner payloads, and complete SBOM documents; those remain access-controlled source artifacts.

The dashboard is an engineering evidence index. It is not a DISA checklist, STIG attestation, Authority to Operate, or proof that the image, registry, host, runtime, or organization is compliant. The common profile covers 20 selected controls from the 188-rule Container Platform SRG. The separate Ubuntu overlay classifies all 194 Ubuntu 24.04 V1R6 rules, but inherited and not-applicable determinations still require appropriate system assessment.