Compare

QuenchWorks vs the hardened-image providers

Hardened, low-CVE container images are now a crowded field: Bitnami (Broadcom), Chainguard, Docker Hardened Images, RapidFort, and Minimus all ship signed, minimal images with SBOMs and provenance. The differences are in access and approach. Bitnami moved its catalog to a commercial offering and froze a legacy registry; Chainguard gives a small free set and gates the rest behind a subscription; Docker opened its Hardened Images as free, Apache-2.0 source in late 2025; RapidFort and Minimus are commercial platforms. QuenchWorks is free, Wolfi-built, and fully public: images, signed charts pinned by digest, and build workflows anyone can read. The table below is conservative on purpose. Where we could not confirm a competitor fact from a primary source, we mark it "Varies" or "Partial" rather than guess. Verify every claim yourself.

Where QuenchWorks is different

Free, no account

Pull images and deploy charts with no subscription, no login, and no registry to add.

Fully public, verifiable

Images, charts, and the proof (SBOM and SLSA provenance) are public for anyone to check.

Charts pinned by digest

Signed Helm charts reference their image by sha256, never a moving tag.

License honesty

Source-available apps are labeled as such, each with an OSI-clean alternative named.

The providers at a glance

QuenchWorks

Free

Independent, fully public hardened catalog. Wolfi-built images and signed Helm charts pinned by digest, no account needed.

Bitnami

Paid

Broadcom's commercial Bitnami Secure Images. The free community catalog was retired, leaving a frozen legacy registry behind.

Chainguard

Freemium

Premium Wolfi-based minimal images. A small Starter set is free; the full catalog is a paid subscription.

Docker

Free

Docker Hardened Images, opened as a free, Apache-2.0 open-source catalog in late 2025. Built on Debian and Alpine.

RapidFort

Varies

Curated, optimized images that strip attack surface from upstream containers. Commercial platform.

Minimus

Paid

Proprietary from-source minimal images. Commercial, with a free program for eligible open-source projects.

Feature by feature

Capability	QuenchWorks	Bitnami	Chainguard	Docker	RapidFort	Minimus
Access & cost
Price / free tier	Free	PaidBitnami Secure Images is commercial; a latest-only hardened community set and a frozen legacy registry remain	FreemiumA small set of Starter images is free; the full catalog is a paid subscription	FreeDocker Hardened Images opened as free, Apache-2.0 open source in Dec 2025	VariesCommercial platform; public pricing for image access is not published	PaidCommercial; a free open-source program exists for eligible projects
Open and free to verify	YesPublic images, charts, and build workflows	PartialFull catalog gated behind a subscription	PartialFull catalog gated behind a subscription	YesFree, open-source catalog with public attestations	PartialCommercial platform; not a fully open catalog	PartialCommercial; open-source program for eligible projects
Build & hardening
Built from source on Wolfi	Yes	NoDebian-based hardening, not Wolfi	YesWolfi-based	NoBuilt on Debian and Alpine	NoCurated / optimized upstream images, not a Wolfi rebuild	NoProprietary from-source build, not Wolfi
0-CVE goal with daily rebuilds	YesHard Trivy gate; a fixable CVE fails the build	YesNear-zero-CVE goal; cadence not publicly specified here	YesNear-zero-CVE goal with frequent rebuilds	YesNear-zero-CVE goal; paid tiers add a remediation SLA	YesNear-zero-CVE goal via continuous hardening	YesNear-zero-CVE goal; paid tiers add a remediation SLA
Multi-arch (amd64 + arm64)	Yes	Yes	Yes	Yes	VariesNot confirmed across the catalog	VariesNot confirmed from a primary source
Supply chain
Signed (cosign keyless)	Yes	YesSigned images	Yes	Yes	YesCryptographic signing	YesCosign signatures
SBOM (SPDX or CycloneDX)	YesSPDX	Yes	Yes	YesSPDX and CycloneDX	Yes	Yes
SLSA build provenance	Yes	PartialAttestations vary by offering	YesSLSA Build Level 2	YesSLSA Build Level 3	YesSLSA Level 3 (per vendor)	YesSLSA Level 3-aligned (per vendor)
Charts & licensing
Helm charts included	Yes	YesBehind the paid catalog	NoImages focused	Yes	PartialCharts-compatible images; integrates with existing charts	YesHelm charts offered
Charts pin images by digest	Yes	VariesNot confirmed here	n/a	VariesNot confirmed here	n/aNo first-party charts	VariesNot confirmed here
License transparency, clean alternatives flagged	YesSource-available apps are labeled, with an OSI-clean alternative named	Partial	Partial	Partial	Partial	Partial

Access & cost

Price / free tier

QuenchWorks: Free
Bitnami: PaidBitnami Secure Images is commercial; a latest-only hardened community set and a frozen legacy registry remain
Chainguard: FreemiumA small set of Starter images is free; the full catalog is a paid subscription
Docker: FreeDocker Hardened Images opened as free, Apache-2.0 open source in Dec 2025
RapidFort: VariesCommercial platform; public pricing for image access is not published
Minimus: PaidCommercial; a free open-source program exists for eligible projects

Open and free to verify

QuenchWorks: YesPublic images, charts, and build workflows
Bitnami: PartialFull catalog gated behind a subscription
Chainguard: PartialFull catalog gated behind a subscription
Docker: YesFree, open-source catalog with public attestations
RapidFort: PartialCommercial platform; not a fully open catalog
Minimus: PartialCommercial; open-source program for eligible projects

Build & hardening

Built from source on Wolfi

QuenchWorks: Yes
Bitnami: NoDebian-based hardening, not Wolfi
Chainguard: YesWolfi-based
Docker: NoBuilt on Debian and Alpine
RapidFort: NoCurated / optimized upstream images, not a Wolfi rebuild
Minimus: NoProprietary from-source build, not Wolfi

0-CVE goal with daily rebuilds

QuenchWorks: YesHard Trivy gate; a fixable CVE fails the build
Bitnami: YesNear-zero-CVE goal; cadence not publicly specified here
Chainguard: YesNear-zero-CVE goal with frequent rebuilds
Docker: YesNear-zero-CVE goal; paid tiers add a remediation SLA
RapidFort: YesNear-zero-CVE goal via continuous hardening
Minimus: YesNear-zero-CVE goal; paid tiers add a remediation SLA

Multi-arch (amd64 + arm64)

QuenchWorks: Yes
Bitnami: Yes
Chainguard: Yes
Docker: Yes
RapidFort: VariesNot confirmed across the catalog
Minimus: VariesNot confirmed from a primary source

Supply chain

Signed (cosign keyless)

QuenchWorks: Yes
Bitnami: YesSigned images
Chainguard: Yes
Docker: Yes
RapidFort: YesCryptographic signing
Minimus: YesCosign signatures

SBOM (SPDX or CycloneDX)

QuenchWorks: YesSPDX
Bitnami: Yes
Chainguard: Yes
Docker: YesSPDX and CycloneDX
RapidFort: Yes
Minimus: Yes

SLSA build provenance

QuenchWorks: Yes
Bitnami: PartialAttestations vary by offering
Chainguard: YesSLSA Build Level 2
Docker: YesSLSA Build Level 3
RapidFort: YesSLSA Level 3 (per vendor)
Minimus: YesSLSA Level 3-aligned (per vendor)

Charts & licensing

Helm charts included

QuenchWorks: Yes
Bitnami: YesBehind the paid catalog
Chainguard: NoImages focused
Docker: Yes
RapidFort: PartialCharts-compatible images; integrates with existing charts
Minimus: YesHelm charts offered

Charts pin images by digest

QuenchWorks: Yes
Bitnami: VariesNot confirmed here
Chainguard: n/a
Docker: VariesNot confirmed here
RapidFort: n/aNo first-party charts
Minimus: VariesNot confirmed here

License transparency, clean alternatives flagged

QuenchWorks: YesSource-available apps are labeled, with an OSI-clean alternative named
Bitnami: Partial
Chainguard: Partial
Docker: Partial
RapidFort: Partial
Minimus: Partial

Bitnami, Chainguard, Docker, RapidFort, and Minimus are all serious engineering, and this page is not a knock on any of them. Several of them ship excellent free options too. QuenchWorks exists to keep a fully free, fully public, no-account path open, with everything from images to charts to build workflows out in the open. Verify any claim here against each provider's own public sources before you rely on it.

Two related projects sit slightly outside this table: Google Distroless ships minimal, language-runtime base images (no app catalog or Helm charts), and Red Hat UBI provides redistributable enterprise base images (a base layer rather than ready-to-run app images). Both are worth knowing about, but they solve a different problem than a hardened application catalog.

QuenchWorks is independent and is not affiliated with, endorsed by, or sponsored by Bitnami, Broadcom, Chainguard, Docker, RapidFort, Minimus, Google, or Red Hat. All product names and trademarks are the property of their respective owners.

Free, hardened, and yours to verify.

Browse the catalog or read the source. No account, no registry to add.

Browse charts Browse images GitHub