Images

195 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 195 available now.

C 1
rust
Hardened Rust toolchain (cargo plus rustc) for build stages; ship the compiled binary on the static base. Latest 3 stable lines (1.94/1.95/1.96).
v1.97.1363.4 MB
Language runtimestandardMIT OR Apache-2.0
A+
RustFS
S3-compatible, high-performance object store written in Rust with a zero-master architecture, positioned as an Apache-2.0 MinIO alternative. Beta/preview.
v1.0.0_beta1282.5 MB3 versions
Object storagelowApache-2.0
A+
ScyllaDB
High-throughput, low-latency wide-column store, API-compatible with Apache Cassandra and DynamoDB. This 6.x build is the final OSS line under AGPL.
v2026.2.278.2 MB
Wide-columnlowAGPL-3.0
B 1
sealed-secrets
Sealed Secrets, the controller that lets you commit encrypted secrets to Git safely. A cluster-side private key decrypts SealedSecret resources into ordinary Kubernetes Secrets, so the encrypted form is the only thing that ever leaves the cluster.
v0.38.414.5 MB3 versions
Security & supply chainstandardApache-2.0
B 1
SeaweedFS
Fast distributed storage for blobs, objects, and files (S3 API) built on Facebook's Haystack design, with O(1) disk seeks for billions of small files. Default object store after MinIO restricted its community edition.
v4.4048.8 MB
Object storagestandardApache-2.0
D 1
Solr
Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections.
v10.0.0333.1 MB
SearchlowApache-2.0
B 3
sonar-scanner-cli
SonarScanner CLI, the standalone scanner that analyzes a project and pushes results to a SonarQube server. Bundles its own OpenJDK. Image only, no chart.
v8.1.0.638985.2 MB
CI/CD & registrystandardLGPL-3.0
B 1
spicedb
Zanzibar-style authorization database for fine-grained permissions over gRPC. From source on a hardened nonroot Wolfi base; the operator supplies the datastore (in-memory, postgres, or cockroach).
v1.56.024.3 MB
IdentitystandardApache-2.0
A+
static
Tiny static base for self-contained binaries from Go or Rust. Nonroot, no shell, no package manager. The only image tagged :latest.
v20260621617.2 KB
Runtime basestandardMIT
B 2
step-ca
Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi base; config and data live under a writable volume.
v0.30.229.6 MB
Security & supply chainstandardApache-2.0
B 1
syft
Anchore's CLI for generating Software Bills of Materials (SBOMs) from container images and filesystems. Image only, no chart.
v1.50.028.6 MB
Security & supply chainstandardApache-2.0
B 3
tekton
Kubernetes-native CI/CD pipelines. Ships the Tekton Pipelines controller, webhook, resolvers, and pod-injected helper binaries, built from source on a hardened nonroot Wolfi base.
v1.14.0117.0 MB
CI/CD & registrystandardApache-2.0