Base image versions
Every built-in base image is rebuilt from its upstream packages, so security updates reach your sandboxes without you rebuilding anything. This page shows what each base is running right now and what changed in each rebuild, package by package. For what each base is for, see Base images.
Current versions
Inside a sandbox
Every image carries the same information in /etc/orkestr-release, so code running in a sandbox can check exactly which build it booted from.
$ cat /etc/orkestr-release
ORKESTR_TEMPLATE="debian-13"
ORKESTR_BUILT_AT="2026-11-10T10:41:07Z"
ORKESTR_GIT_SHA="bc0c5f41..."
ORKESTR_OS="Debian GNU/Linux 13 (trixie)"
ORKESTR_PYTHON="3.13.5"
ORKESTR_NODE=""
ORKESTR_PACKAGES="183"
ORKESTR_PACKAGES_SHA256="..."The same data is available from the API, without authentication. The digest is the SHA-256 of the image itself.
curl https://api.orkestr.eu/v1/templates/baseThe full package list of each base, with versions, so you can check an image against a security advisory without starting a sandbox. Inside a sandbox, dpkg -l on Debian and Ubuntu, or apk info -v on the bases that ship apk, lists the same packages.
curl https://api.orkestr.eu/v1/templates/base/debian-13/packages
# => {"name": "debian-13", "built_at": "...", "digest": "sha256:...",
# "packages": ["adduser 3.152", "apt 3.0.3", ...]}