Documentation
Book a demo

Integrations

Integrating with WizOS

How to integrate with WizOS Images using Cloudsmith

WizOS, offered by Wiz, is a catalog of hardened container base images featuring:

  • Near-zero CVEs, with strict SLAs (7 days for criticals, 14 for highs/mediums)
  • Cryptographically verifiable provenance and signatures
  • Minimal, built from source with only necessary components using glibc for broad compatibility

You can retrieve these images through Cloudsmith by enabling the upstream to the WizOS Registry.

Upstream configuration

Form FieldDescription
NameA descriptive name for this upstream source. A shortened version of this name will be used for tagging cached packages retrieved from this upstream.
PriorityThe weighting of the Upstream source. Upstream sources are selected for resolving requests by sequential order (1..n), followed by creation date.
Proxy URLThe URL for this upstream source. This must be a fully qualified URL including any path elements required to reach the root of the repository.
Proxy OnlyProxy requests through to upstream sources in order to match assets that are not present in this repository.
Cache and ProxyProxy the initial request for an asset through to the upstream source and then store (cache) resolved assets in this repository for future requests.
Verify SSL CertificatesIf enabled, SSL certificates are verified when requests are made to this upstream. We recommend leaving this enabled for all public sources to help mitigate Man-In-The-Middle (MITM) attacks.
AuthenticationThe credentials used to authenticate with a privately accessible upstream source.
Headers (optional)Optional key-value headers that can be passed to upstreams with each request.

Adding the WizOS registry as an upstream

You can integrate the WizOS registry into your Cloudsmith account by adding a WizOS upstream.

WizOS Registry credentials

To find your WizOS Registry credentials, sign in to your WizOS tenant, click Profile > Tenant Info, then in the General tab, scroll to the Wiz Registry Credentials section and select WizOS Registry.

  1. Navigate to a repository and select Upstreams/Sources.
  2. Click Add upstream or Configure upstream.
  3. Select the Hardened images tab.
  4. In the Name field, enter a descriptive name for the upstream.
  5. In the Priority field, specify a priority for the upstream. For more information about upstream priority, see Upstream concepts: Priority.
  6. The Proxy URL field is pre-filled with the WizOS registry URL: https://registry.os.wiz.io.
  7. Under Package delivery, select Cache and proxy.
  8. Click Additional options.
  9. Under Source type, select Private.
  10. Under Authentication type, select Basic Auth and enter your WizOS Registry Username and Password.
  11. (Optional) In the Headers section, add key-value headers to pass to the upstream with each request.
  12. Select the Verify SSL certificate option to ensure that SSL certificates are verified.
  13. Click + Add upstream.

Your WizOS upstream appears on the Upstream registries section of the Sources tab.

Pull a WizOS image with Docker Native Tooling

To pull the wizos-base Docker image into Cloudsmith after you've configured your Cloudsmith upstream for WizOS:

  1. Configure a Cloudsmith upstream for WizOS by using the instructions in Adding the WizOS registry as an upstream.
  2. Ensure that Docker is installed on your system. For more information about installing Docker, see the Docker: Install Docker Engine documentation.
  3. Open a terminal.
  4. Log in to Docker using your Cloudsmith username and token:
    bash
    docker login docker.cloudsmith.io
  5. Pull the WizOS wizos-base image by running the following command, replacing WORKSPACE and REPOSITORY with your Cloudsmith workspace and repository:
    bash
    docker pull docker.cloudsmith.io/WORKSPACE/REPOSITORY/wizos-base:latest
  6. Check your Cloudsmith repository to find the newly added WizOS image.