Charts

136 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 136 charts.

A+
Valkey
BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. QuenchWorks' default cache and the recommended Redis drop-in replacement.
chart v · app v9.1.1
CachecriticalBSD-3-Clause
A+
varnish
HTTP reverse-proxy cache (web accelerator) that fronts an origin and serves its responses from memory, cutting backend load and tail latency. Caching policy is VCL, which varnishd compiles to native code at startup. The chart supplies the VCL and the backend.
chart v · app v9.0.3
CachestandardBSD-2-Clause
0 CVE
vault
Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets, leasing, and PKI. Shipped under the Business Source License 1.1, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Built from source without the web UI; the 1.20.x line is CVE-blocked upstream and not shipped.
chart v0.0.1 · app v2.0.3
SecretslowBUSL-1.1
A+
Vector
High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks.
chart v · app v0.56.0
ObservabilitystandardMPL-2.0
B 1
velero
CNCF backup and disaster-recovery tool for Kubernetes cluster resources and persistent volumes. Single static Go binary on a hardened nonroot Wolfi base; object-store and snapshot backends are the operator's choice.
chart v · app v1.18.2
Storage & platformstandardApache-2.0
A+
victorialogs
Fast, cost-efficient logs database with the LogsQL query language. Single static Go binary on a hardened nonroot Wolfi base; log data lives on a writable volume.
chart v · app v1.51.0
ObservabilitystandardApache-2.0
A+
VictoriaMetrics
Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Drop-in long-term storage or full replacement for Prometheus.
chart v · app v1.148.0
Time serieslowApache-2.0
B 2
vikunja
Self-hosted to-do and project management app (lists, kanban, gantt, calendar) serving both the API and the Vue web UI. From source with the UI embedded on a hardened nonroot Wolfi base; SQLite or an external SQL database.
chart v · app v2.3.0
Apps & productivitystandardAGPL-3.0+
C 3
vllm
vLLM, the high-throughput LLM inference and serving engine with an OpenAI-compatible API. CPU build — installs vLLM's prebuilt CPU wheel (torch+cpu, no source compile, no CUDA) into a venv on a hardened Wolfi python-3.12 base, 0-CVE across ~140 Python packages. The user supplies the model; the chart runs it as a StatefulSet with a persistent model cache.
chart v · app v0.24.0
Machine learning & AIstandardApache-2.0
B 1
weaviate
Open-source AI-native vector database for semantic search and retrieval-augmented generation, with hybrid keyword plus vector queries.
chart v · app v1.38.8
Search & vectorstandardBSD-3-Clause
B 2
woodpecker
Lightweight, container-native CI/CD engine (a Drone-compatible fork) with a server, agent, and CLI. From source (Vue UI embedded in the static Go server) on a hardened nonroot Wolfi base.
chart v · app v3.16.0
CI/CD & registrystandardApache-2.0
A+
wordpress
WordPress, the PHP content-management system and blogging platform. Reconstructed clean-room from the official release on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), not the php:apache upstream image. The image ships no wp-config.php; the chart supplies one via ConfigMap and provides a MySQL backend.
chart v · app v7.0.2
Apps & productivitystandardGPL-2.0+