Every image comes from the same packages in the Sandcastle Base and Common repositories, shaped for a different place to run. These pages cover what each one is for and how to get it running.
The files themselves, with their sizes and checksums, are on the Download page. Every version ever published is in the image archive.
Each image ships its SBOMs in SPDX and CycloneDX, a license report, and an image.json listing the package closure and the SHA-256 of every file in the build. image.json.sig is the signature over that image.json, and checking it is covered in the signatures guide.
A GNOME desktop that boots from a USB stick on real hardware, running as a live system with the installer pinned to the dash. Most people will want this one. Write it to the whole stick, not to a partition on it.
A hybrid live ISO for hosting providers and hypervisors that take nothing but an uploaded ISO. It boots to a text console rather than a desktop, and reads a cidata or config-2 seed if one is attached.
A headless qcow2 disk image for VMs. It boots to a console and grows to fill its disk, and has no login of its own - the account, its SSH key, the hostname and the repositories all come from a config drive.
A Windows Subsystem for Linux distribution - a console system running systemd on WSL's own kernel. Install it with wsl --install --from-file, or import it on a WSL older than 2.4.4.
A minimal OCI base image with bash, CA certificates and pkg, and the Sandcastle repositories already configured. It is glibc and bash rather than musl and busybox, and pkg install grows it into whatever you need.
