# Base image versions

Every built-in base image is rebuilt from its upstream packages, so security updates reach your sandboxes without you rebuilding anything. This page shows what each base is running right now and what changed in each rebuild, package by package. For what each base is for, see [Base images](https://orkestr.eu/docs/sandboxes/base-images).

## Current versions

> **Could not load versions**
>
> The version list is temporarily unavailable. Try again in a minute, or query the API directly (below).

## Inside a sandbox

Every image carries the same information in `/etc/orkestr-release`, so code running in a sandbox can check exactly which build it booted from.

```bash
$ cat /etc/orkestr-release
ORKESTR_TEMPLATE="debian-13"
ORKESTR_BUILT_AT="2026-11-10T10:41:07Z"
ORKESTR_GIT_SHA="bc0c5f41..."
ORKESTR_OS="Debian GNU/Linux 13 (trixie)"
ORKESTR_PYTHON="3.13.5"
ORKESTR_NODE=""
ORKESTR_PACKAGES="183"
ORKESTR_PACKAGES_SHA256="..."
```

The same data is available from the API, without authentication. The digest is the SHA-256 of the image itself.

```bash
curl https://api.orkestr.eu/v1/templates/base
```

The full package list of each base, with versions, so you can check an image against a security advisory without starting a sandbox. Inside a sandbox, `dpkg -l` on Debian and Ubuntu, or `apk info -v` on the bases that ship apk, lists the same packages.

```bash
curl https://api.orkestr.eu/v1/templates/base/debian-13/packages
# => {"name": "debian-13", "built_at": "...", "digest": "sha256:...",
#     "packages": ["adduser 3.152", "apt 3.0.3", ...]}
```

## Changelog