Images

195 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 195 available now.

A+
varnish
HTTP reverse-proxy cache (web accelerator) that fronts an origin and serves its responses from memory, cutting backend load and tail latency. Caching policy is VCL, which varnishd compiles to native code at startup. The chart supplies the VCL and the backend.
v9.0.3196.0 MB3 versions
CachestandardBSD-2-Clause
0 CVE
vault
Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets, leasing, and PKI. Shipped under the Business Source License 1.1, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Built from source without the web UI; the 1.20.x line is CVE-blocked upstream and not shipped.
v2.0.389.6 MB
SecretslowBUSL-1.1
A+
Vector
High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks.
v0.57.032.5 MB
ObservabilitystandardMPL-2.0
B 1
velero
CNCF backup and disaster-recovery tool for Kubernetes cluster resources and persistent volumes. Single static Go binary on a hardened nonroot Wolfi base; object-store and snapshot backends are the operator's choice.
v1.18.230.3 MB
Storage & platformstandardApache-2.0
A+
victorialogs
Fast, cost-efficient logs database with the LogsQL query language. Single static Go binary on a hardened nonroot Wolfi base; log data lives on a writable volume.
v1.51.09.8 MB
ObservabilitystandardApache-2.0
A+
VictoriaMetrics
Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Drop-in long-term storage or full replacement for Prometheus.
v1.148.010.9 MB
Time serieslowApache-2.0
B 2
vikunja
Self-hosted to-do and project management app (lists, kanban, gantt, calendar) serving both the API and the Vue web UI. From source with the UI embedded on a hardened nonroot Wolfi base; SQLite or an external SQL database.
v2.3.029.7 MB
Apps & productivitystandardAGPL-3.0+
C 3
vllm
vLLM, the high-throughput LLM inference and serving engine with an OpenAI-compatible API. CPU build — installs vLLM's prebuilt CPU wheel (torch+cpu, no source compile, no CUDA) into a venv on a hardened Wolfi python-3.12 base, 0-CVE across ~140 Python packages. The user supplies the model; the chart runs it as a StatefulSet with a persistent model cache.
v0.25.1946.4 MB
Machine learning & AIstandardApache-2.0
B 1
weaviate
Open-source AI-native vector database for semantic search and retrieval-augmented generation, with hybrid keyword plus vector queries.
v1.38.869.0 MB
Search & vectorstandardBSD-3-Clause
B 2
woodpecker
Lightweight, container-native CI/CD engine (a Drone-compatible fork) with a server, agent, and CLI. From source (Vue UI embedded in the static Go server) on a hardened nonroot Wolfi base.
v3.16.059.2 MB
CI/CD & registrystandardApache-2.0
A+
wordpress
WordPress, the PHP content-management system and blogging platform. Reconstructed clean-room from the official release on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), not the php:apache upstream image. The image ships no wp-config.php; the chart supplies one via ConfigMap and provides a MySQL backend.
v7.0.293.7 MB3 versions
Apps & productivitystandardGPL-2.0+
A+
xyops
xyops, a workflow-automation and server-monitoring system (job scheduler, monitors, alerting, ticketing) by the creator of Cronicle. Built from source on Wolfi nodejs-22 (native better-sqlite3), nonroot on a hardened read-only-rootfs base. Single-instance with an embedded SQLite store on a persistent volume; the chart runs it as a StatefulSet.
v1.0.8685.0 MB
WorkflowstandardBSD-3-Clause