ما هو مطروح، وما هو التالي

منصّة استكشاف بيانات ولوحات معلومات لذكاء الأعمال (BI) مدعومة بقاعدة بيانات بيانات وصفية (metadata) وRedis.

واجهة تصوير ولوحات معلومات لـ OpenSearch.

قاعدة بيانات متجهية قابلة للتوسّع لأعباء عمل الذكاء الاصطناعي.

API and schema registry for Kafka, Avro, and Protobuf. Measured 2026-09-25: the 3.3.3 app distribution carries 467 findings; 26 in-place jar swaps clear all but opentelemetry-api 1.57.0 (CVE-2026-45292, fixed only in 1.62.0), which adds packages the prebuilt Quarkus index cannot load. Needs a source build that regenerates the index.

بث متوافق مع Kafka. متاح المصدر (source-available)، وليس مفتوح المصدر وفق OSI.

بديل نظيف: Kafka or Pulsar (Apache-2.0), both already shipped.

Cilium's own patched Envoy; not reusable from our stock envoy image. Measured 2026-10-19: Wolfi packages only cilium-envoy-1.19 at 1.19.3, behind our cilium lines (1.18.15, 1.19.9, 1.20.3), and cilium/proxy builds Envoy with Bazel (hours per arch, past the CI budget). Hold until Wolfi tracks each cilium line; the cilium chart keeps L7 proxy off until then.

اكتشاف الخدمات وشبكة الخدمات. متاح المصدر (source-available)، وليس مفتوح المصدر وفق OSI.

بديل نظيف: Kuma (Apache-2.0) -- already shipped; or Linkerd / Istio.

Envoy-based sidecar for Consul. MPL, so cleaner than the BUSL server.

The operator that makes Consul work on Kubernetes.

شبكة خدمات (service mesh) مبنية على Envoy: إدارة حركة المرور، وmTLS، وقابلية الملاحظة (observability). بحجم منصّة كاملة، وهي موجة متعددة الصور (مستوى التحكم istiod إضافة إلى وكلاء Envoy الجانبيين والبوابات) بدلاً من صورة واحدة.

مجدوِل أعباء العمل (workload scheduler). متاح المصدر (source-available)، وليس مفتوح المصدر وفق OSI.

Operator for Percona XtraDB Cluster (MySQL): synchronous multi-primary HA via Galera, with automated backups and point-in-time recovery. Image SHIPPED 2026-09-27 (1.18.0, 1.19.1, 1.20.0; it is also the pods' init image). Chart HELD: in the kind gate the operator creates the cluster and its init containers complete, but the Percona 8.4.8 database pod starts mysqld with wsrep provider none and never becomes ready, and it does the same with upstream's init image and with the 8.0 database image. Percona's forum reports the same failure in kind and minikube on Linux; the chart waits for a gate on a non-kind cluster.

قاعدة بيانات متعددة النماذج للمستندات والرسوم البيانية وأزواج المفتاح-القيمة (الإصدار المجتمعي).

Database schema change and migration management. Relicensed: 5.x is under the Functional Source License 1.1 (source-available, Apache-2.0 two years after each release, competing use restricted); the last Apache-2.0 release is 4.33.0 and its line is no longer patched. Flyway (Apache-2.0) covers the same job.

MongoDB Community Kubernetes Operator: replica-set HA, automated failover, and TLS via CRDs. The operator is Apache-2.0; note the MongoDB server it deploys is SSPL (not OSI). Held 2026-10-07: the community operator repo is archived; its successor mongodb/mongodb-kubernetes (1.13.0, Apache-2.0 for Community clusters) runs every member beside mongodb-agent, a closed-source binary its Dockerfile downloads prebuilt (agent 109.0.1.9310-1), which cannot be built or scanned.

قاعدة بيانات متعددة النماذج. متاح المصدر (source-available)، وليس مفتوح المصدر وفق OSI.

Real-time key-value database; community edition is AGPL.

Distributed document database. Source-available, not OSI.

بديل نظيف: CouchDB (Apache-2.0), already shipped.

قاعدة بيانات رسوم بيانية موزّعة فوق خلفيات تخزين قابلة للتوصيل (pluggable).

تفرّع متعدد الخيوط (multi-threaded) لـ Redis؛ مرخّص بـ BSD ومتوافق مع بروتوكول Redis.

Modern Redis/Valkey desktop GUI (Wails/Go+Vue). A desktop client, not a deployable server, so it falls outside the hardened in-cluster image model — a web Redis UI (e.g. redis-commander) would be the cache-stack UI instead.

مخزن كائنات موزّع وقابل للتوسّع (S3 + HDFS).

منصّة PaaS قابلة للاستضافة الذاتية على Docker Swarm. ذات نواة مفتوحة (open-core): معظمها مرخّص بـ Apache-2.0، أما أجزاء /proprietary فمتاحة المصدر (DSAL-1.0). لا تناسب الكتالوج المُحصَّن: فهي تتطلّب صلاحيات الجذر (root) ومقبس Docker (Docker socket) وSwarm مُهيّأ، ولذلك لا يمكن تشغيلها بصلاحيات غير الجذر (nonroot) أو للقراءة فقط (read-only).

بديل نظيف: Coolify (Apache-2.0), already shipped.

S3-compatible object storage; relicensed to AGPL-3.0. Held 2026-10-08: minio/minio is archived (README: no longer maintained; the alternatives are the proprietary AIStor editions), last release RELEASE.2025-10-15T17-29-55Z. An archived server gets no CVE fixes. SeaweedFS, Garage, RustFS and Ceph (RGW) are the S3 options in the catalog.

بديل نظيف: SeaweedFS / Garage / RustFS (Apache-2.0), all already shipped.

فحص مستمر لجودة الشيفرة وأمنها.

أداة بناء بقليل من الشيفرة (low-code) للأدوات الداخلية ولوحات الإدارة، مدعومة بـ PostgreSQL وRedis.

منصّة نقاشات ومنتديات بلغة Ruby مدعومة بـ PostgreSQL وRedis.

واجهة API عديمة الحالة (stateless) لتحويل HTML ومستندات Office إلى PDF.

نظام إدارة تعلّم بلغة PHP مدعوم بـ MySQL أو MariaDB أو PostgreSQL.

Self-hosted team chat platform backed by MongoDB. Measured 2026-10-20 at 8.9.0: the official build compiles apps/meteor/ee/ and ee/ (Rocket.Chat Enterprise license, not OSI) into the same Meteor bundle, so a clean MIT-only image means a source build with the ee packages removed; the upstream image also scans 160 fixable npm findings in 44 packages. Hold until a source build without ee/ is sized.

تطبيق لإدارة علاقات العملاء (CRM) بلغة PHP مدعوم بـ MySQL أو MariaDB.

Headless browser for rendering, scraping, and PDF export.

Enterprise wiki and structured collaboration platform. Measured 2026-10-14 (17.10.13 LTS and 18.8.0): recipe written, held before CI. After safe jar swaps 8 fixable findings remain on both lines: bundled solr-core 9.4.1 (fixes need Solr 9.8 to 9.10.1, a whole Solr and Lucene jar set), the Jetty 10.0.26 client (fixes only on Jetty 11/12, no 10.x release) and opennlp-tools (fix only in 2.x). XWiki master still pins Solr 9.4.1. Unblocks with an XWiki release on Solr 9.10.1 or newer and a fixed Jetty client.

خادم وسائط ذاتي الاستضافة للأفلام والموسيقى والتلفزيون المباشر.

مخزن بيانات OLAP موزّع في الزمن الحقيقي للتحليلات منخفضة الكمون (latency).

أتمتة عمليات وتنسيق BPMN يشمل محرك Zeebe.

قاعدة بيانات تحليلات في الزمن الحقيقي لاستعلامات OLAP عالية التزامن.

Semantic layer and analytics API over your data. Held 2026-10-20 (images apps/cube): the server needs the Rust addon @cubejs-backend/native, and a from-source build of 1.8.8 compiles flatbuffers 2.1.2 (CRITICAL), thrift 0.13.0 and lexical-core 0.8.5 from Cube's pinned 2022 arrow/datafusion forks. Unblock: a release that moves cubesql off those forks.

أداة بناء بصرية لتطبيقات LLM وسير عمل الوكلاء (agents).

منصّة قابلية ملاحظة وتتبّع لـ LLM مدعومة بـ PostgreSQL.

واجهة ويب ذاتية الاستضافة للمحادثة مع نماذج LLM المحلية والبعيدة.

Self-hosted chat-with-your-documents LLM application. Measured 2026-10-20 at v1.18.0: the upstream image scans 445 fixable npm findings in 61 packages, ships 24 native .node addons, and runs on Prisma's prebuilt Rust query engine (libquery_engine .so.node), which the scanner cannot read. Hold until a build with prisma-engines from source (cargo auditable) is sized.

ML pipeline orchestration on Kubernetes. Partly built 2026-10-20 (2.17.2): api-server, persistence agent, scheduled workflow controller, driver, launcher and frontend images ship 0-CVE (images 405e86c8). The chart is held: v2 runs need the ML Metadata store server, whose binary (Wolfi 1.17.1, upstream 1.21.0) statically links sqlite 3.39.2, zlib 1.2.12, gRPC 1.46.3, MariaDB Connector/C 3.0.8 and libpq 12.1, invisible to the scanner. Unblock: an MLMD release on current libraries, or our own Bazel build against Wolfi system libraries.

High-performance serving system for TensorFlow models. Measured 2026-10-20 at 2.21.0: tensorflow_model_server is a Bazel build of all of TensorFlow (hours per arch, past the CI budget), and the official binary links TensorFlow, gRPC, protobuf and absl statically, so the scanner cannot read what is inside. Hold until a source build fits the CI budget.

تصوير ولوحات معلومات لـ Elasticsearch. التوزيعة الافتراضية مرخّصة بـ Elastic-2.0، وليست مفتوحة المصدر وفق OSI.

بديل نظيف: OpenSearch Dashboards (Apache-2.0) over OpenSearch, both open.

مسار معالجة سجلات وأحداث من جانب الخادم. التوزيعة الافتراضية مرخّصة بـ Elastic-2.0، وليست مفتوحة المصدر وفق OSI.

بديل نظيف: Vector (MPL-2.0) or Fluentd (Apache-2.0), both open pipelines.

Percona Monitoring and Management — deep MySQL/PostgreSQL/MongoDB observability (query analytics) built on Prometheus, Grafana and VictoriaMetrics. AGPL, OSI-approved. Sized 2026-10-08 at v3.9.1 (no release binaries): pmm-server is one container that an Ansible playbook assembles on Oracle Linux 9 from eight RPMs built in the repo (pmm-managed, qan-api2, vmproxy, pmm-dump, pmm-ui, percona-dashboards) plus Percona forks of Grafana (12.4.5, frontend changes, so a full Node build unlike our grafana image) and VictoriaMetrics (pmm-6401-v1.149.0), with ClickHouse, PostgreSQL 14, nginx and supervisord in the same image. Several images of work plus a multi-process supervisor design; it waits for local gates (the btrfs metadata hold).

Horizontally scalable, multi-tenant Prometheus storage. Held 2026-10-05: four prometheus/prometheus CVEs (two HIGH) are fixed only in 0.311.3 (Prometheus 3.11.3), but Cortex 1.21.1 is on 0.308.1 and imports tsdb/errors, removed in Prometheus 3.10; Cortex master is on 0.309.1 and still imports it. Unblocks when a Cortex release moves to Prometheus 3.11.

سلطة شهادات PKI مؤسسية (الإصدار المجتمعي) مدعومة بقاعدة بيانات علائقية.

مستوى وصول يوفّر وصولاً قائماً على الهوية إلى SSH وKubernetes وقواعد البيانات. الإصدار المجتمعي مرخّص بـ AGPL-3.0.

Programmable CI/CD engine that runs pipelines in containers. Sized 2026-09-27: the CLI is plain Go, but the engine image bundles runc, CNI plugins and the Go, Python and TypeScript SDK runtimes as builtin content that upstream builds with Dagger itself. A multi-day build; not started.

منصّة SIEM وXDR بمكوّنات مدير (manager) ومفهرس (indexer) ولوحة معلومات (dashboard).

Build container images inside Kubernetes without a daemon. Held 2026-09-25: Google archived it in June 2025 (continued as osscontainertools/kaniko 1.28 and chainguard-dev/kaniko 1.25), and the executor unpacks image layers over its own root filesystem, so it must run as root, against the nonroot rule. BuildKit rootless is the likelier fit.

Ollama (or vLLM) + Open WebUI + Qdrant — self-hosted LLM serving, a chat UI, and a vector DB for retrieval-augmented generation. Qdrant is built; needs Ollama/vLLM + Open WebUI images.

Apache Superset + Trino + PostgreSQL — federated SQL analytics with self-service BI dashboards. PostgreSQL is built; needs Superset + Trino.

Operator-based HA MongoDB: MongoDB Community Operator + a metrics exporter — replica-set failover. CRD-driven. The operator is Apache-2.0, but MongoDB itself is SSPL (not OSI), so the stack inherits that caution.

بديل نظيف: FerretDB (Apache-2.0) on the pg-ha-stack — a MongoDB-compatible, fully-open document database over PostgreSQL.

Umbrella: OpenSearch + OpenSearch Dashboards — search with a UI. Held 2026-10-07: chart built and gated (OpenSearch document found through Dashboards), but it bundles the opensearch-dashboards image, which is held (see that entry).

Full DevOps platform (Git forge + CI/CD + registry). Heavy fit: a large Ruby monolith that bundles PostgreSQL, Redis, Gitaly, Sidekiq and Workhorse, and the gitlab-org/gitlab repo is mostly EE-proprietary — only the CE-flagged code is MIT. Far from the minimal one-purpose hardened model.

بديل نظيف: Gitea or Forgejo — lightweight, fully-open Git forges that drop straight into the gitops-stack.

Run virtual machines as Kubernetes workloads. Sized 2026-10-08 at v1.9.0: upstream assembles its images with Bazel from CentOS Stream 9 RPMs (libvirt, qemu-kvm, passt). Wolfi has qemu 11.1.2 but no libvirt or passt package, so virt-launcher needs both built from source alongside the Go components (virt-operator, virt-api, virt-controller, virt-handler); it waits for local gates.

Self-hosted Git server with built-in CI/CD, issues and kanban (Java). Heavier than Gitea/Gogs but far lighter than GitLab; an all-in-one gitops-stack backend option. Measured 2026-10-07 at 16.8.5 (47 findings): jackson-databind/core 2.22.2 in lib/ swap cleanly, but Hazelcast 5.7.0 (its newest release) relocates jackson 2.21.2 and tools.jackson 3.1.2 under com/hazelcast/shaded/, which needs a bytecode relocation rewrite or a Hazelcast release; logback 1.4.14 needs the 1.5 line; boot/ ships prebuilt Tanuki wrapper binaries.

Java API gateway. shenyu-bootstrap + shenyu-admin; admin needs a database. Held 2026-10-19: the 2.7.1 dists (trivy rootfs) carry 234 (admin) and 309 (bootstrap) fixable findings, 27 CRITICAL, on Spring Boot 3.3.1 / Spring 6.1.10 whose fixes sit in Boot 4 and Spring 7, plus Shiro 1.13 (fix 2.x), Tomcat 10.1.25 and fastjson 1.2.76; not jar-swappable. Unblock: an upstream release on a current Spring line.

Alibaba's Istio+Envoy-based gateway. Two components (higress-core, higress-console) and it inherits Istio/Envoy build weight. Measured 2026-10-20 at v2.2.5: the gateway image runs Higress's own patched Envoy (a Bazel build, hours per arch, past the CI budget; same wall as Cilium Envoy) plus pilot-agent, and scans 163 Go findings; the controller scans 85 Go findings on top of 446 Ubuntu ones. The Go parts are buildable; the patched Envoy is the hold.

Zalando's HTTP router. BLOCKING: GitHub reports NOASSERTION and the LICENSE fetch came back empty -- resolve the license before writing a recipe.