Skip to content
QuenchWorks

195 hardened images ·136 signed charts · 225 open · 70 fixable CVEs

Hardened, zero-CVE images and charts for the infrastructure you run.

136 datastores shipped end-to-end as small nonroot container images and signed Helm charts. Built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, digest-pinned, and multi-arch. Free and independent.

Browse the chartsView on GitHub
install & verify
# add the chart (OCI) and install
helm install my-redis oci://ghcr.io/quenchworks/charts/redis

# verify the image was built & signed by CI before you trust it
cosign verify ghcr.io/quenchworks/images/redis:8.8.0 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Pull, verify, deploy. No account.

A real terminal, end to end: run a 0-CVE image, check its cosign signature, install the Helm chart, and watch the workload reach Running.

Terminal: docker runs a QuenchWorks Python image and prints its version, cosign verifies the image signature, helm installs the Valkey chart, the pod reaches Running, and Valkey replies PONG.

Hardened from source to install.

Built from source

We compile each app from source on Wolfi with melange, then apko assembles a small nonroot image. No Dockerfiles, and nothing inherited from another distro.

0 fixable CVEs, daily

A Trivy gate fails the build on any fixable CVE. We rebuild every day, because a clean scan only tells you about the day it ran.

Signed and attested

Every image is cosign-signed, with an SLSA build-provenance attestation and an SPDX SBOM attached to the same digest. Verify all three from your own terminal.

Pinned by digest

Charts point at images by sha256 digest, never a moving tag. What you install is exactly what passed the gate.

Covers the stack you actually run.

195 hardened images and136 signed charts across34 categories: relational and document stores, caches, search, streaming, coordination, observability, object storage, gateways, and a registry — plus hardened base images to build FROM, all underimages.

Browse all 136 charts

Free, independent, and yours to verify.

No paywall and no lock-in. Pull an image, check the signature yourself, then install the chart. You never have to take our word for it.

Browse the chartsRequest an app