Available now
Ghost Containers
FIPS-enabled, CIS hardened images of the software your programs already run. Same names, same versions. Signed, with SBOMs and provenance your authorizing official can verify.
docker pull ghost.local/postgres:17
Government Hardened Open Source Technology
Ghost hardens the containers and libraries your programs already run. Signed, documented, and delivered into your registry. One price for the whole organization.
The software you already run, rebuilt on a CIS hardened, FIPS-enabled Ghost base.
Every artifact gets scanned and ships with CycloneDX and SPDX SBOMs.
Right entrypoint, right version, expected behavior. Hardened and still useful.
Cosign signatures and provenance, delivered into a registry you operate.
After that, Ghost keeps watching. When upstream ships a fix, the artifact is rebuilt, retested, re-signed, and delivered again.
Containers and libraries ship today. Operating systems and AI models are next, because that is where government programs are headed.
FIPS-enabled, CIS hardened images of the software your programs already run. Same names, same versions. Signed, with SBOMs and provenance your authorizing official can verify.
docker pull ghost.local/postgres:17
The top 3,000 open source packages: the 1,000 most-used from each of PyPI, Maven Central, and npm. Scanned, with binary provenance analysis, so you know what is inside a dependency before it is compiled into something you deliver.
Search the 3,000Hardened Linux as cloud AMIs, ISOs for bare metal and enclaves, and VM images for on premise.
Open weight and embedding models, scanned and delivered with the same reports as any other dependency.
The packages your developers pull every day, already checked.
Most of what ends up in a build was never picked by a person. It came along with something else. Ghost Libraries covers the 1,000 most-used packages in each of the three biggest registries, so the dependency tree stops being a guess.
| Rank | Package | Registry | Ghost |
|---|---|---|---|
| #1 | boto3 | PyPI | Checked |
| #1 | junit:junit | Maven Central | Checked |
| #1 | semver | npm | Checked |
| #2 | packaging | PyPI | Checked |
| #5 | org.projectlombok:lombok | Maven Central | Checked |
| #2 | debug | npm | Checked |
| #7 | requests | PyPI | Checked |
| #7 | org.slf4j:slf4j-api | Maven Central | Checked |
| #9 | chalk | npm | Checked |
Day 366
Everything lands in infrastructure you operate. Your right to keep running what was delivered is perpetual and written into the license. No license server. No callback. No kill switch. If a contract lapses or a continuing resolution stalls, your programs keep running.
$ docker pull ghost.local/nginx:1.29
1.29: Pulling from ghost/nginx
Status: Image is up to date
# subscription ended 11 months ago
# still running
Air gap is not a special edition. It is the same product, delivered a different way, with its own service agreement.
Pull directly, or mirror into a registry inside your boundary.
Scheduled delivery of artifacts, signatures, SBOMs, and reports as a verifiable bundle.
One-way and physical transfer supported. Nothing calls home.
Move artifacts across enclaves and classification levels inside your organization.
Some vendors measure remediation from the day a CVE is disclosed. For most software, no fix exists yet on that day. Our clock starts when upstream ships a fix. The timelines live in the service agreement on your order.
We rebuild, scan, sign, and deliver on the timeline in your service agreement. Connected, disconnected, or air gapped. That part is contractual.
You get the VEX statement, the exploitability assessment, and any mitigation available. Your ISSM makes a documented risk decision instead of waiting.
Metered pricing makes your security budget grow every time your program does. Ghost is priced against the organization on your order. Everything inside that boundary is unlimited.
Get a price for your organizationGhost derives from SBIR work, which supports sole-source award under 15 U.S.C. 638(r). No competition required. No dollar ceiling.
Delivered under DFARS 252.227-7018. Government rights are defined by the clause and stated in the license.
GSA MAS, SEWP V, ITES-SW2, an active Navy BOA, and Carahsoft.
No seat count to estimate. No inventory to prepare. A person reads every one of these. No drip campaign. No auto-reply.