Charts

136 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 136 charts.

A+
drupal
Drupal core, the open-source CMS and content framework. Built from the official release tarball on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord); the chart supplies settings.php via ConfigMap and a MySQL backend. Ships the 11.3/11.4 lines (11.2 is held because drupal/core-recommended pins guzzle below its CVE fix).
chart v0.0.8 · app v11.4.4
Apps & productivitystandardGPL-2.0+
A+
Elasticsearch
Distributed search and analytics engine. Shipped under SSPL/Elastic License, which are not OSI-approved; OpenSearch (Apache-2.0) is the open drop-in fork.
chart v0.0.11 · app v9.4.3
SearchlowSSPL-1.0
A+
emqx
Massively scalable, distributed MQTT broker for IoT, IIoT, and connected vehicles. Speaks MQTT 5.0 over TCP/TLS/websockets with a clustering engine and a web dashboard. Packaged from EMQX's official Erlang/OTP release. Licensed BSL 1.1 (single node free; clustering requires a commercial license).
chart v0.0.5 · app v6.2.2
MessagingstandardBUSL-1.1
A+
envoy
Cloud-native L7 proxy and communication bus, the data plane behind API gateways and service meshes. HTTP/gRPC routing, load balancing, rich observability, and an admin/health endpoint. The chart supplies the bootstrap config.
chart v0.0.4 · app v1.38.1
GatewaystandardApache-2.0
B 2
etcd
Distributed, strongly consistent key-value store using Raft consensus. The backing store for Kubernetes and a building block for service coordination and config.
chart v0.0.15 · app v3.7.1
CoordinationcriticalApache-2.0
A+
excalidraw
Open-source virtual whiteboard for sketching hand-drawn-style diagrams. Self-hostable as a static SPA served by hardened nginx, with no backend or account required.
chart v0.0.6 · app v0.18.1
Apps & productivitystandardMIT
B 1
external-secrets
External Secrets Operator, the CNCF operator that syncs secrets from external APIs (AWS/GCP/Azure Secrets Manager, Vault, and many more) into Kubernetes Secrets. The single controller binary also serves the webhook and cert-controller, with every provider compiled in.
chart v0.0.8 · app v2.8.0
Security & supply chainstandardApache-2.0
B 1
FerretDB
MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension. The clean-license substitute for MongoDB.
chart v0.0.11 · app v2.7.0
DocumentstandardApache-2.0
F 3
filebrowser
Web-based file manager with a built-in UI, users, and share links. From source (Vite UI embedded in a static Go binary) on a hardened nonroot Wolfi base; data and served roots are volumes.
chart v0.0.5 · app v2.63.17
Apps & productivitystandardApache-2.0
A+
floci
Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE. The hardened image runs all 55 of Floci's in-process AWS services nonroot with no Docker socket, covering S3, DynamoDB, SQS, SNS, SES, IAM, STS, KMS, Secrets Manager, API Gateway, Cognito, Kinesis, CloudFormation, Step Functions, EventBridge, CloudWatch, Route53, and more. The 10 Docker-backed services (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune) need the host Docker socket plus root and are out of scope for this image.
chart v0.2.10 · app v1.5.34
Apps & productivitystandardMIT
A+
Fluent Bit
Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends.
chart v0.0.9 · app v5.0.9
ObservabilitystandardApache-2.0
B 1
forgejo
Self-hosted lightweight Git forge (a community Gitea fork) with issues, PRs, CI, and packages. From source with the web UI embedded (no Node at runtime), CGO+static-musl SQLite, on a hardened nonroot Wolfi base; data lives on a writable volume.
chart v0.0.5 · app v15.0.3
GitstandardGPL-3.0+