Skip to content

Container and Ubuntu STIG evidence

Indian Hill Labs applies one common STIG gap profile to every container built by this repository. The profile gives engineers and assessors a consistent place to see which selected controls have direct evidence, which are only partially addressed, which are inherited from the platform, and which remain implementation gaps.

The common container source is the DISA Container Platform SRG V2R4, dated October 28, 2025. Its downloaded archive SHA-256 is 975a9e421e62e0ea52b1824e4a719aee87eed9070d5a3145fa9817f6498d99fe. The benchmark contains 188 rules: 8 High, 177 Medium, and 3 Low.

This is not a STIG compliance claim

The common profile is a project gap assessment and evidence index. It is not a DISA checklist, an Authority to Operate, or an attestation that an image, host, registry, or container platform is STIG compliant. A qualified assessor must apply the official checks and evaluate the complete system and organizational context.

Common profile

IHL-STIG-CONTAINER-COMMON-1 selects 20 controls that materially intersect the current image, pipeline, supply-chain, and private-lab runtime design. The initial engineering assessment records:

Status Count Meaning
evidence-supported 10 Direct project evidence supports the current implementation, subject to assessor review.
partially-supported 9 Some implementation or evidence exists, but the complete requirement is not satisfied.
inherited 1 The platform or host must provide and prove the control.

Protected publications now receive keyless digest signatures and exact-identity verification, and GitLab has a reviewed registry cleanup policy. Important partial items still include package verification, platform-wide registry admission, a measured 30-day update objective, complete audit evidence, automated vendor-support checks, and externally verifiable exports of GitLab control-plane settings.

The other 168 benchmark rules are not silently treated as passing or not applicable. They are outside this common image profile and require platform, host, registry, identity, audit, incident-response, or organization-specific overlays.

Ubuntu 24.04 Chiseled applicability overlay

Every image also receives the IHL-STIG-UBUNTU-24.04-CONTAINER-1 overlay. Its source is DISA's Canonical Ubuntu 24.04 LTS STIG V1R6, dated July 1, 2026. The source archive SHA-256 is 2468e7fc35dc9e70ed6d1b7c87f5354b0cc9632882afafed6bad43cf49f2b837; the manual XCCDF SHA-256 is 6002cfcb32e1294aef0116f08186a79d7127212d30af1c804692a48468c8946b.

The V1R6 benchmark contains 194 rules: 16 High, 161 Medium, and 17 Low. Unlike the 20-control common profile, the Ubuntu overlay explicitly classifies every rule. Its reviewed starting point is:

Status Controls Boundary
evidence-supported 6 Prohibited package absence and constrained runtime networking.
partially-supported 26 Image integrity, file metadata, package trust, least privilege, error handling, and vendor support.
inherited 102 Host audit, kernel, network, time, storage, and organization controls.
not-applicable 58 Interactive login, SSH, PAM/SSSD, graphical, and mutable package-manager functions absent from the Chiseled image.
planned-gap 2 FIPS 140-3 module provenance and DOD CA trust policy.

These counts can change for an individual digest. CI checks the Syft package and file inventory for Ubuntu 24.04 identity, prohibited packages, interactive binaries, package manager executables, unsafe library and command permissions, privileged or world-writable files, and SHA-256 coverage. If a future image gains a shell, package manager, or prohibited package, affected not-applicable or evidence-supported determinations are automatically downgraded in that digest's report.

The Ubuntu STIG is written for a complete operating system. A Chiseled image has no kernel, bootloader, init system, SSH daemon, PAM login stack, audit daemon, or graphical desktop. The overlay records the boundary explicitly instead of installing those components merely to run a host-oriented scanner. Inherited and not-applicable decisions still require assessor approval.

Per-container evidence

The hardened:qualification pipeline job creates the following files for every built image:

  • <artifact>.stig-gap.json for automation and durable evidence packaging;
  • <artifact>.stig-gap.md for direct review of the common Container Platform profile;
  • <artifact>.ubuntu-image.json for automated Chiseled userspace checks;
  • <artifact>.ubuntu-stig.json for the complete Ubuntu V1R6 applicability model; and
  • <artifact>.ubuntu-stig.md for human review of all 194 Ubuntu rules.

The preceding scan:container-compliance job also creates one digest-bound compliance plan per image and, for every registered profile, raw XCCDF XML, ARF XML, an HTML report, and normalized JSON. The scanner version and the hashes of every catalog-installed data stream are retained with those results. The raw upstream Ubuntu STIG and CIS Level 1 profiles currently provide report-only baseline evidence; the reviewed V1R6 Chiseled applicability overlay remains the enforced Ubuntu release decision.

Each report contains the exact repository@sha256:... identity, source revision, benchmark and profile identity, selected control mapping, status counts, assessment notes, and an evidence catalog. Every catalog entry includes its path, byte length, and SHA-256 hash. Required inputs include the container source, BuildKit metadata, SBOM, complete vulnerability scan, policy summary, CI definition, and shared deployment controls. Artifact-specific runtime observations are included where available.

The generator fails when an image is identified only by a tag, a required evidence file is missing, the baseline and profile rule sets differ, or a profile references an unknown status or evidence type. Lab promotion additionally requires STIG_GAP_PROFILE_VALID=true and UBUNTU_STIG_APPLICABILITY_VALID=true. Those values mean only that both evidence packages are complete, digest-bound, and internally consistent; they do not mean the artifact passed a STIG. The export job manifests and hashes the Ubuntu JSON reports alongside the existing dashboard inputs.

Review in GitLab

Open the private Container Assurance Dashboard for a combined view of control status, vulnerabilities, SBOM summaries, runtime observations, and remediation actions. For the complete source reports, open the pipeline, select the hardened:qualification job, and choose Browse artifacts. Under pipeline-evidence/, review the common *.stig-gap.md and complete *.ubuntu-stig.md reports first, and retain the JSON reports for machine processing. Candidate reports remain available for 30 days. Protected release evidence is additionally bound to the unchanged manifest SHA-256, retained as one-year job artifacts, and uploaded to the GitLab Generic Package Registry.

GitLab's Secure > Vulnerability report remains the correct interface for scanner findings. The selected STIG controls are mapped to GitLab Requirements and updated by the export:assurance-evidence report. The separate dashboard project consumes that exact manifested artifact; richer project-specific evidence remains in the private dashboard and retained artifacts rather than the vulnerability report.

Controlled sources

The reusable source files are:

  • compliance/stig/baselines/container-platform-v2r4.json — benchmark metadata, selected official rule identifiers, and short project summaries;
  • compliance/stig/profiles/common-container.json — project status, layer, evidence expectations, and assessment notes;
  • ci/generate_stig_evidence.py — digest-bound report generator; and
  • ci/test_generate_stig_evidence.py — fail-closed profile and report tests;
  • compliance/stig/baselines/ubuntu-24.04-v1r6.json — complete derived V1R6 rule metadata and authoritative source hashes;
  • compliance/stig/profiles/ubuntu-24.04-container.json — explicit classification of every Ubuntu V1R6 rule;
  • ci/import_ubuntu_stig_baseline.py — controlled XCCDF metadata importer;
  • ci/assess_ubuntu_image.py — digest-bound package and file metadata assessment;
  • ci/generate_ubuntu_stig_evidence.py — complete applicability report generator;
  • ci/test_generate_ubuntu_stig_evidence.py — fail-closed Ubuntu profile, identity, and downgrade tests;
  • compliance/container-compliance/catalog.json — reusable image-to-profile bindings and pinned SCAP content sources;
  • tools/openscap/install_content.py — checksum-verifying catalog content installer;
  • ci/run_compliance_catalog.py and ci/run_container_openscap.py — generic digest-bound external scanner orchestration;
  • compliance/gitlab/requirements.json — one-to-one GitLab Requirement IID mapping; and
  • ci/export_assurance_evidence.py — cross-report identity validator, Requirement result generator, and exact-job evidence manifest builder.

The repository does not copy the full official benchmark text. Reviewers should use the source archive linked above for the authoritative discussion, checks, and fixes.