Images

195 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 195 available now.

A+
adminer
vrana's single-file PHP database manager, a web UI for MySQL/MariaDB, PostgreSQL, and SQLite, served by a hardened PHP runtime. Image only, no chart.
v5.5.115.6 MB3 versions
Apps & productivitystandardApache-2.0
A+
airflow
Apache Airflow, the programmatic workflow orchestration platform for authoring, scheduling, and monitoring DAGs. Built clean-room from source as a Python venv on Wolfi (python-3.12, official constraints), nonroot on a hardened read-only-rootfs base. Ships the 3.2 line (older lines carry unfixed CVEs in Airflow itself). Runs api-server + scheduler + dag-processor + triggerer (and Celery workers) from one image; needs PostgreSQL (and Redis for CeleryExecutor), provided by the chart.
v3.3.0113.6 MB2 versions
WorkflowstandardApache-2.0
B 2
Alertmanager
Companion to Prometheus that routes, groups, deduplicates, and silences alerts and dispatches them to email, Slack, PagerDuty, and more.
v0.33.124.2 MB
ObservabilitystandardApache-2.0
A+
ansible
Ansible — agentless IT automation and configuration management (the community `ansible` package plus ansible-core and curated collections) with ssh/git/rsync/sshpass tooling, ready to run playbooks. Built from source into a venv on a hardened nonroot Wolfi base. Image only, no chart.
v14.2.0127.0 MB2 versions
CI/CD & registrystandardGPL-3.0+
B 2
argo-workflows
Kubernetes-native workflow engine for orchestrating parallel jobs as DAGs. Ships the workflow-controller and the argo CLI/API server with an embedded React UI, built from source on a hardened nonroot Wolfi base.
v3.7.1564.4 MB
WorkflowstandardApache-2.0
A+
aspnet
Hardened ASP.NET Core runtime for web apps and APIs, no SDK. Build on the dotnet image, then run here. Lines 8/9/10.
v10.0.11072.2 MB3 versions
Runtime basestandardMIT
D 3
Atlantis
Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state locking.
v0.46.074.5 MB
GitOpsstandardApache-2.0
B 1
authelia
Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion for reverse proxies. Packaged from Authelia's official prebuilt binary; needs a config plus a SQLite or PostgreSQL storage backend.
v4.39.2021.7 MB
IdentitystandardApache-2.0
B 1
authentik
Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on Wolfi as a four-language image (nodejs web UI, Go server/proxy, Rust worker, Python/Django core via uv) on a hardened nonroot base; FIPS mode is not forced and the license-gated MaxMind GeoIP download is omitted. Needs PostgreSQL and Redis at runtime, provided by the chart.
v2026.5.6229.7 MB
Secrets & identitystandardMIT
B 1
blackbox-exporter
Prometheus exporter that probes endpoints externally over HTTP, HTTPS, TCP, DNS, and ICMP for black-box uptime and latency monitoring.
v0.28.08.9 MB
Metrics/ExporterstandardApache-2.0
B 1
buildkite-agent
The Buildkite CI build-runner agent that executes pipeline jobs on your own infrastructure. Image only, no chart.
v3.135.016.6 MB3 versions
CI/CD & registrystandardMIT
A+
bun
Hardened Bun runtime and toolkit (runtime, bundler, package manager) for JavaScript and TypeScript. Latest stable (1).
v1.3.1438.1 MB3 versions
Language runtimestandardMIT