Skip to content

2026.02.09

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Feb 07:44
· 71 commits to main since this release
2026.02.09
cd19dea
This commit was created on GitHub.com and signed with GitHub鈥檚 verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

馃殌 Docker Images for This Release

This release provides multi-architecture Docker images (amd64, arm64, and arm) published to both Docker Hub and GitHub Container Registry (GHCR).

馃敼 Docker Hub

Note: Docker Hub is the world's most popular public container registry, but it enforces anonymous pull limits. If you are automating deployments or have many servers, consider using GHCR below to avoid interruptions.

Repository: homeall/cloudflared
Tags available: latest, 2026.02.09
Image Digest: sha256:97e680fc31648f6cbfca869f3faca71c7b3bc47534066caa8cb381294402b695

Pull commands:

docker pull homeall/cloudflared:latest
docker pull homeall/cloudflared:2026.02.09

馃敼 GitHub Container Registry (GHCR)

GHCR offers higher pull rate limits, strong integration with GitHub, and is recommended for most CI/CD or cloud-native environments.

Repository: ghcr.io/homeall/cloudflared
Tags available: latest, 2026.02.09

Pull commands:

docker pull ghcr.io/homeall/cloudflared:latest
docker pull ghcr.io/homeall/cloudflared:2026.02.09

Pull by digest:

docker pull ghcr.io/homeall/cloudflared@sha256:97e680fc31648f6cbfca869f3faca71c7b3bc47534066caa8cb381294402b695

馃敀 Supply Chain Security

These images are signed and include:

  • SLSA Provenance: Downloadable and verifiable from the GitHub UI.
  • Cosign signatures: For tamper-evidence and trust.

How to verify:

1. Verify the image signature (recommended for everyone)

cosign verify \
  --certificate-identity "https://github.com/homeall/cloudflared/.github/workflows/main.yml@refs/heads/main" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  ghcr.io/homeall/cloudflared:@sha256:97e680fc31648f6cbfca869f3faca71c7b3bc47534066caa8cb381294402b695

2. Download provenance/SBOM from the workflow run artifacts below.

Then verify with:

gh attestation verify --owner homeall <provenance-or-sbom-file.json>

Links:

Download the 'spdx.json' or provenance artifact from the run above to verify.

Note: 'cosign verify-attestation' is not supported for this release, as attestations are not yet published to the registry. Use the provenance file and 'gh attestation verify' instead.

See Sigstore Cosign Docs and GitHub Attestation Docs for full instructions.

Need help or want to report an issue?

Open an issue on GitHub.

Assets 2
Loading