metabase

Registry namespace metabase · ranked #20 of tracked publishers by 3·A + B = 0

PROJECTS

2

IMAGES TRACKED

22

SCANNED

0 / 22

AVG SCORE

—

REBUILT ≤90D

20 / 22

Images we track

22 total · 0 scanned · sorted by current score

Mariadb · mariadb

metabase/mariadb

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.58.34.x

· 635 MB · 2-arch · pushed 23d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.58.35.x

· 635 MB · 2-arch · pushed 8d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.59.31.x

· 647 MB · 2-arch · pushed 2d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.62.19.x

· 744 MB · 2-arch · pushed 23d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.17

· 781 MB · 2-arch · pushed 29d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.17.1

· 781 MB · 2-arch · pushed 28d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.17.2

· 781 MB · 2-arch · pushed 27d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.17.x

· 781 MB · 2-arch · pushed 24d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.18

· 781 MB · 2-arch · pushed 23d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.18.1

· 778 MB · 2-arch · pushed 20d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.18.2

· 778 MB · 2-arch · pushed 14d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.18.3

· 778 MB · 2-arch · pushed 10d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.18.4

· 778 MB · 2-arch · pushed 10d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.18.x

· 776 MB · 2-arch · pushed 9d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.19

· 778 MB · 2-arch · pushed 8d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.19.1

· 778 MB · 2-arch · pushed 7d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.19.2

· 778 MB · 2-arch · pushed 3d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.63.19.x

· 779 MB · 2-arch · pushed 2d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.64.0.x

· 828 MB · 2-arch · pushed 3d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

Metabase · metabase/metabase

metabase/metabase:v0.64.1.x

· 828 MB · 2-arch · pushed 2d ago

NOW

—

FIRST SCAN

—

OPEN CVES

—

How grades on this page work

Each image is scored 0–100 by the cerodeo-v1 Scout rubric. Grade bands: A ≥ 85 B ≥ 70 C ≥ 55 D ≥ 40 F < 40.

An image starts at 100 and loses points for open CVEs: −25 per fixable Critical, −10 fixable High, −3 fixable Medium, −8 unfixable Critical, −3 unfixable High. It earns points back for hygiene: non-root default (+10), rebuilt in last 90 days (+10), cosign signature (+5), SLSA provenance (+5), SHA256 pinned (+5), SBOM attestation (+3), HEALTHCHECK (+3), OCI labels (+3), multi-arch (+2–3), upstream GH release (+3), README example (+2).

So an A-grade image means: no critical and few-to-no high fixable CVEs, plus most hygiene signals present. A publisher with many A grades is one that consistently hits both — not just avoiding CVEs by accident, but shipping with signed provenance, non-root defaults, and timely rebuilds. The AVG SCORE above is the average 0–100 Scout score across the 0 scanned images in this namespace.

Full rubric with every weight at /about/grades. Changes to any weight ship as a new rubric_version so old snapshots stay auditable.