Charts
10 chartsApps & productivity charts
Hardened Helm charts in the apps & productivity category. Each deploys our hardened image pinned by its signed digest, with production defaults.
0 CVEdrupal
Drupal core, the open-source CMS and content framework. Built from the official release tarball on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord); the chart supplies settings.php via ConfigMap and a MySQL backend. Ships the 11.3/11.4 lines (11.2 is held because drupal/core-recommended pins guzzle below its CVE fix).
chart v0.0.8 · app v11.4.4
التطبيقات والإنتاجيةstandardGPL-2.0+- 0 CVE
excalidraw
Open-source virtual whiteboard for sketching hand-drawn-style diagrams. Self-hostable as a static SPA served by hardened nginx, with no backend or account required.
chart v0.0.6 · app v0.18.1
التطبيقات والإنتاجيةstandardMIT - 0 CVE
filebrowser
Web-based file manager with a built-in UI, users, and share links. From source (Vite UI embedded in a static Go binary) on a hardened nonroot Wolfi base; data and served roots are volumes.
chart v0.0.5 · app v2.63.17
التطبيقات والإنتاجيةstandardApache-2.0 - 0 CVE
floci
Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE. The hardened image runs all 55 of Floci's in-process AWS services nonroot with no Docker socket, covering S3, DynamoDB, SQS, SNS, SES, IAM, STS, KMS, Secrets Manager, API Gateway, Cognito, Kinesis, CloudFormation, Step Functions, EventBridge, CloudWatch, Route53, and more. The 10 Docker-backed services (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune) need the host Docker socket plus root and are out of scope for this image.
chart v0.2.10 · app v1.5.34
التطبيقات والإنتاجيةstandardMIT - 0 CVE
ghost
Open-source Node.js publishing platform for blogs, newsletters, and membership sites. Packaged from Ghost's official npm distribution on a hardened Wolfi Node 22; configured entirely via environment and backed by an external MySQL/MariaDB with a content PVC for themes, images, and data.
chart v0.0.8 · app v6.54.1
التطبيقات والإنتاجيةstandardMIT - 0 CVE
miniflux
Minimalist, opinionated RSS and Atom feed reader with a clean web UI and a REST API. Single pure-Go static binary on a hardened nonroot Wolfi base; needs PostgreSQL at runtime (operator-provided).
chart v · app v2.3.2
التطبيقات والإنتاجيةstandardApache-2.0 - 0 CVE
nextcloud
Nextcloud, the self-hosted file-sync and content-collaboration platform. Reconstructed clean-room on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs); the chart installs via occ and provides a MariaDB backend. Nextcloud is AGPL-3.0-only (strong copyleft).
chart v · app v34.0.2
التطبيقات والإنتاجيةstandardAGPL-3.0 - 0 CVE
pocketbase
Open-source backend in a single file with an embedded SQLite database, auth, file storage, realtime subscriptions, and an admin dashboard over a REST API. Pure-Go static binary (UI embedded) on a hardened nonroot Wolfi base; state on a writable volume.
chart v · app v0.39.5
التطبيقات والإنتاجيةstandardMIT - 0 CVE
vikunja
Self-hosted to-do and project management app (lists, kanban, gantt, calendar) serving both the API and the Vue web UI. From source with the UI embedded on a hardened nonroot Wolfi base; SQLite or an external SQL database.
chart v · app v2.3.0
التطبيقات والإنتاجيةstandardAGPL-3.0+ - 0 CVE
wordpress
WordPress, the PHP content-management system and blogging platform. Reconstructed clean-room from the official release on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), not the php:apache upstream image. The image ships no wp-config.php; the chart supplies one via ConfigMap and provides a MySQL backend.
chart v · app v7.0.2
التطبيقات والإنتاجيةstandardGPL-2.0+