Charts

136 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 136 charts.

B 1
navidrome
Self-hosted music server and streamer compatible with the Subsonic/OpenSubsonic API, with a modern web UI. From source (React UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; music and data on writable volumes.
chart v · app v0.62.0
Media & streamingstandardGPL-3.0
A+
Neo4j
Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Community edition is GPLv3.
chart v · app v2026.05.0
GraphlowGPL-3.0
C 1
nextcloud
Nextcloud, the self-hosted file-sync and content-collaboration platform. Reconstructed clean-room on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs); the chart installs via occ and provides a MariaDB backend. Nextcloud is AGPL-3.0-only (strong copyleft).
chart v · app v34.0.2
Apps & productivitystandardAGPL-3.0
A+
nginx
High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends.
chart v · app v1.30.4
GatewaycriticalBSD-2-Clause
A+
nsq
Realtime distributed messaging platform. Ships nsqd, nsqlookupd, and nsqadmin as static Go binaries on a hardened nonroot Wolfi base; nsqd data path is a writable volume.
chart v · app v1.3.0
MessagingstandardMIT
B 1
ntfy
Simple HTTP-based pub-sub notification service for sending push notifications to phones and desktops from any script. From source with the web UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.
chart v · app v2.25.0
MessagingstandardApache-2.0
B 1
oauth2-proxy
Reverse-proxy authentication layer that secures upstream apps by delegating sign-in to OIDC and OAuth2 providers.
chart v · app v7.15.3
Secrets & identitystandardMIT
0 CVE
observability-stack
Hardened, operator-free observability stack: Prometheus + Grafana + Alertmanager + kube-state-metrics + node-exporter + cAdvisor, wired together for metrics, alerting, and populated Kubernetes dashboards.
chart v0.0.4 · app v1.0.0
StacksstandardUnknown
B 1
ollama
Local LLM runtime that pulls, runs, and serves open models (Llama, Gemma, Qwen, DeepSeek, and more) behind a simple REST API. CPU-only image; the chart mounts a writable volume for the model store.
chart v · app v0.32.5
Machine learning & AIstandardMIT
D 2
opa
Open Policy Agent, the CNCF general-purpose policy engine. Evaluates Rego policies over JSON and YAML to enforce authorization, admission control, and configuration rules across the stack.
chart v · app v1.18.2
Security & supply chainstandardApache-2.0
B 1
OpenBao
Open-source secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. The Linux Foundation MPL-2.0 community fork of HashiCorp Vault.
chart v · app v2.6.1
SecretsstandardMPL-2.0
A+
openfga
Fine-grained authorization engine (Zanzibar-style relationship-based access control) over HTTP and gRPC. From source on a hardened nonroot Wolfi base; datastore is the operator's choice.
chart v · app v1.18.1
IdentitystandardApache-2.0