4 ms·
Show HN: Signal.fyi – Are You Managing the Hidden Costs of Public Docker Images?
Hey HN,
I built signal.fyi to address a problem I’ve seen firsthand: managing public Docker images isn’t as “free” as it seems. From tracking vulnerabilities to ensuring compliance, the hidden costs add up—especially for small teams without the resources of larger organizations.
What signal.fyi Does:
- Daily Scans: Automatically checks your public Docker images for vulnerabilities and parent image updates.
- Enriched Pull Requests: Summarizes vulnerabilities and parent image changes right in your PRs, helping teams isolate risks and streamline reviews.
- Public Dashboards & Reports: Provides no-login-required, shareable compliance reports for stakeholders and audits.
Why It Matters:
Managing public Docker images manually is time-intensive. Based on research (inspired by Chainguard’s Report: https://get.chainguard.dev/true-cost-of-vulnerability-management?ref=lftsolutions.com https://get.chainguard.dev/true-cost-of-vulnerability-manage...), teams can spend thousands of hours annually on CVE management and compliance prep. Signal.fyi automates these processes to:
- Improve visibility into security risks.
- Track changes to your parent Docker image—a critical yet often overlooked metric.
- Create an audit trail to align with frameworks like NIST’s Secure Software Development Framework (SSDF).
Who It’s For:
Teams that manage source code via github and rely on public Docker images and want to reduce security risks.
Organizations looking to simplify compliance while improving transparency.
Why Now:
We’ve written about the hidden costs of managing public Docker images—are you prepared to address them? You can read more here:
https://www.lftsolutions.com/are-you-managing-the-hidden-costs-of-public-docker-images/ https://www.lftsolutions.com/are-you-managing-the-hidden-cos...
Try signal.fyi:
Setup takes under 5 minutes, and you’ll get actionable insights within 24 hours: https://github.com/marketplace/www-signal-fyi https://github.com/marketplace/www-signal-fyi
I’d love your feedback—what resonates with you, and how can signal.fyi solve your challenges better?
This is an improvement over the two below previous posts:
https://news.ycombinator.com/item?id=42122864 https://news.ycombinator.com/item?id=42122864
https://news.ycombinator.com/item?id=40989006 https://news.ycombinator.com/item?id=40989006
- mdaniel 2y agoYou're not doing yourself any favors by having the 2 pricing choices be "free for one repo" and "call us". That second one could be anything which doesn't incentivize anyone to waste 30 minutes to find out how "over the barrel" it is. You need one point in the middle to allow readers to draw a line
- kcrane3576 2y agoFair point, and I appreciate the feedback. Right now, scaling is definitely doable, but I’m still handling some manual tasks daily as I continue refining the process. I can absolutely deliver on the promise, 'Set up before you can brew a cup of coffee. Receive your first pull request before tomorrow's stand-up,' but it does mean working closely with each customer at this stage. I’m working on automating more of the setup process to streamline scaling further while still keeping that fast turnaround time. In the meantime, I’m handling things on a per-customer basis to ensure everything runs smoothly. Let me know if you think there’s anything else I should focus on to improve the experience!
- kcrane3576 2y agoMy earlier response didn’t do a great job addressing the core issue. To improve, I’ve introduced a new tier: "Starting at $7 / Public Docker Image / Month." This provides more clarity for smaller setups while still allowing flexibility for larger use cases through tailored plans. Right now, I’m keeping a queue to ensure every customer gets a consistent and high-quality experience as we grow. Thanks again for your feedback.
- mdaniel 2y agoMy feedback is that no one needs more reports they need more resolutions so what does your product offer to help find, or track the lifecycle of, fixes?
- kcrane3576 2y agoThanks for the feedback—it’s a valid point, and I’ve been giving a lot of thought to how teams define and approach 'fixes.' In some cases, a fix might mean something as significant as transitioning away from a public parent Docker image to a 0-CVE solution. That said, this is part of a broader phase-two conversation. Right now, I’m focused on building the foundational layer: keeping things transparent, pulling and sharing public data, and addressing the larger challenges around public Docker image management. Expanding into customer-specific features is definitely on the roadmap, but we’re taking it step by step. I’d love to hear about the challenges you’ve faced managing fixes and dependencies—what would make the biggest difference for your team?