Images

195 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 195 available now.

C 1
n8n
Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.
v2.32.6398.4 MB
WorkflowstandardLicenseRef-n8n-Sustainable-Use-License-1.0
A+
n8n-runners
n8n external task-runner sidecar — isolates and executes workflow code (JS/Python) out of the main n8n process for security and scale. Built from source on Wolfi. Image only, no chart.
v2.32.6181.6 MB
WorkflowstandardLicenseRef-n8n-Sustainable-Use-License-1.0
B 1
NATS
Lightweight, high-performance messaging system for cloud-native pub/sub and request-reply, with optional JetStream persistence and streaming.
v2.14.36.6 MB3 versions
MessagingstandardApache-2.0
B 1
navidrome
Self-hosted music server and streamer compatible with the Subsonic/OpenSubsonic API, with a modern web UI. From source (React UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; music and data on writable volumes.
v0.62.022.2 MB
Media & streamingstandardGPL-3.0
A+
Neo4j
Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Community edition is GPLv3.
v2026.05.0243.5 MB
GraphlowGPL-3.0
C 1
nextcloud
Nextcloud, the self-hosted file-sync and content-collaboration platform. Reconstructed clean-room on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs); the chart installs via occ and provides a MariaDB backend. Nextcloud is AGPL-3.0-only (strong copyleft).
v34.0.2436.7 MB
Apps & productivitystandardAGPL-3.0
A+
nginx
High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends.
v1.30.411.5 MB3 versions
GatewaycriticalBSD-2-Clause
C 1
node
Hardened Node.js runtime with npm, a 0-CVE signed nonroot base image for JavaScript apps. Active LTS lines (20/22/24).
v26.5.060.3 MB3 versions
Language runtimestandardMIT
B 1
node-exporter
Prometheus exporter for host-level hardware and OS metrics (CPU, memory, disk, network) on Linux machines.
v1.12.16.5 MB
Metrics/ExporterstandardApache-2.0
A+
nsq
Realtime distributed messaging platform. Ships nsqd, nsqlookupd, and nsqadmin as static Go binaries on a hardened nonroot Wolfi base; nsqd data path is a writable volume.
v1.3.011.0 MB3 versions
MessagingstandardMIT
B 1
ntfy
Simple HTTP-based pub-sub notification service for sending push notifications to phones and desktops from any script. From source with the web UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.
v2.25.020.4 MB
MessagingstandardApache-2.0
B 1
oauth2-proxy
Reverse-proxy authentication layer that secures upstream apps by delegating sign-in to OIDC and OAuth2 providers.
v7.15.39.9 MB
Secrets & identitystandardMIT