World map

 

BM

World D5: Ship & Shield · Boss challenge

Publish safely

You will learn: to publish a non-root image with an SBOM to GHCR, with zero critical holes.

Checked with Docker Engine 29 on 31 Oct 2026

The problem

Your laptop~/kedai-api

  • No open hatches

Lunchboxes (containers)

  • No containers yet

Frozen packs (images)

  • kedai-api:1.06 layers · 244MB
  • node:24-alpine4 layers · 244MB

Boss: publish Kedai’s API to GHCR. Three rules: not root, an SBOM inside, zero CRITICAL holes. Room 1 first: the pack still runs as root.

Try it

Room 1: add USER node to the end of the recipe. Then build kedai-api:1.0 again.

Your laptop~/kedai-api

  • No open hatches

Lunchboxes (containers)

  • No containers yet

Frozen packs (images)

  • kedai-api:1.06 layers · 244MB
  • node:24-alpine4 layers · 244MB

Check

Room 2: your rule is zero CRITICAL. Sort each finding from last night’s scan.

Drag a card into a box. Or tap the card, then tap the box.

      Watch

      bash
      trivy image --severity CRITICAL --exit-code 1 kedai-api:1.0
      …
      echo $?
      0

      Your API pack, scanned for real. Exit code 0: zero CRITICAL holes. Rule 3 holds.

      Try it

      Room 3: ship it to GHCR. Your GitHub token is in $CR_PAT. Log in with it, then tag and push.

      Your laptop~/kedai-api

      • No open hatches

      Lunchboxes (containers)

      • No containers yet

      Frozen packs (images)

      • kedai-api:1.06 layers · 244MB
      • node:24-alpine4 layers · 244MB

      Check

      Room 4: the pack must carry its ingredients list. Build the one command that builds, labels and pushes.

      Tap the pieces in the right order.

      …

      Try it

      Final room, for real, with your Kedai Kancil API (Mission 1).

      Real mission

      1. read -s CR_PAT && export CR_PAT
      2. echo $CR_PAT | docker login ghcr.io -u YOUR-NAME --password-stdin
      4. docker buildx build --sbom=true --provenance=mode=max -t ghcr.io/YOUR-NAME/kedai-kancil-api:1.0.0 --push .
      5. trivy image --severity CRITICAL --exit-code 1 ghcr.io/YOUR-NAME/kedai-kancil-api:1.0.0
      6. git tag v1.0.0 && git push origin v1.0.0

      0 of 6 steps done · Your ticks are saved.

      Check

      GitHub’s public API can see your repo and its tags. It cannot see packages without a login.

      Check it on GitHub

      Your username is sent only to api.github.com.

      • Your kedai-kancil repo is publicNot checked yet
      • It has a version tag, like v1.0.0Not checked yet

      Check

      Check the rest yourself.

      Self-check

      2. docker inspect -f '{{.Config.User}}' ghcr.io/YOUR-NAME/kedai-kancil-api:1.0.0
      3. docker buildx imagetools inspect ghcr.io/YOUR-NAME/kedai-kancil-api:1.0.0

      0 of 4 steps done · Your ticks are saved.

      You did it!

      You can now publish a safe, labelled image to a registry.