Charts

312 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 312 charts.

D 12
argocd
Argo CD, the CNCF declarative GitOps continuous-delivery controller for Kubernetes. One multi-call binary serves every component (server,…
chart v0.0.25 · app v3.4.12
GitOpsstandardApache-2.0
D 9
Atlantis
Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state…
chart v0.0.25 · app v0.48.2
GitOpsstandardApache-2.0
A 3
authelia
Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion…
chart v0.0.41 · app v4.39.28
IdentitystandardApache-2.0
D 12
authentik
Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on…
chart v0.1.48 · app v2026.8.5
Secrets & identitystandardMIT
A+
backdrop
Backdrop CMS, the PHP content-management system forked from Drupal 7. The official release zip on a hardened Wolfi php-8.4-fpm + nginx runtime…
chart v0.0.7 · app v1.35.2
Apps & productivitystandardGPL-2.0+
0 CVE
backup-stack
Hardened Kubernetes backup: Velero with its AWS plugin, backing up to SeaweedFS over S3 in the same install, with generated keys, a bucket created at…
chart v0.0.12 · app v1.0.0
StacksstandardUnknown
A+
bind
ISC BIND 9, the authoritative and recursive DNS server (9.20 stable line). Wolfi's source-built named, nonroot on port 5353, with a default…
chart v0.0.4 · app v9.20.30
CoordinationstandardMPL-2.0
A 3
blackbox-exporter
Prometheus exporter that probes endpoints externally over HTTP, HTTPS, TCP, DNS, and ICMP for black-box uptime and latency monitoring.
chart v0.0.8 · app v0.28.0
Metrics/ExporterstandardApache-2.0
B 14
buildkit
BuildKit, the concurrent container image build engine behind docker build, as the rootless variant: buildkitd runs under rootlesskit as uid 1001 on…
chart v0.0.11 · app v0.33.1
Security & supply chainstandardApache-2.0
0 CVE
cache-stack
Hardened cache stack with metrics: Valkey (Redis-compatible) with a redis_exporter sidecar, Prometheus discovering it in the release namespace, and…
chart v0.0.17 · app v1.0.0
StacksstandardUnknown
D 8
Caddy
Web server and reverse proxy with fully automatic HTTPS via Let's Encrypt and a simple Caddyfile config.
chart v0.0.19 · app v2.11.7
GatewaystandardApache-2.0
D 11
cadence
Fault-tolerant, stateful workflow orchestration engine by Uber. Ships the cadence server and CLI as static Go binaries on a hardened nonroot Wolfi…
chart v0.0.26 · app v1.4.2
WorkflowstandardMIT