Images

195 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 195 available now.

B 2
etcd
Distributed, strongly consistent key-value store using Raft consensus. The backing store for Kubernetes and a building block for service coordination and config.
v3.7.121.5 MB
CoordinationcriticalApache-2.0
A+
excalidraw
Open-source virtual whiteboard for sketching hand-drawn-style diagrams. Self-hostable as a static SPA served by hardened nginx, with no backend or account required.
v0.18.128.4 MB
Apps & productivitystandardMIT
B 1
external-dns
Synchronizes Kubernetes Services and Ingresses with DNS providers so records are managed automatically. Image only, no chart.
v0.21.033.6 MB
Coordination & meshstandardApache-2.0
B 1
external-secrets
External Secrets Operator, the CNCF operator that syncs secrets from external APIs (AWS/GCP/Azure Secrets Manager, Vault, and many more) into Kubernetes Secrets. The single controller binary also serves the webhook and cert-controller, with every provider compiled in.
v2.8.051.8 MB
Security & supply chainstandardApache-2.0
B 1
FerretDB
MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension. The clean-license substitute for MongoDB.
v2.7.010.2 MB
DocumentstandardApache-2.0
F 3
filebrowser
Web-based file manager with a built-in UI, users, and share links. From source (Vite UI embedded in a static Go binary) on a hardened nonroot Wolfi base; data and served roots are volumes.
v2.63.1815.6 MB2 versions
Apps & productivitystandardApache-2.0
A+
floci
Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE. The hardened image runs all 55 of Floci's in-process AWS services nonroot with no Docker socket, covering S3, DynamoDB, SQS, SNS, SES, IAM, STS, KMS, Secrets Manager, API Gateway, Cognito, Kinesis, CloudFormation, Step Functions, EventBridge, CloudWatch, Route53, and more. The 10 Docker-backed services (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune) need the host Docker socket plus root and are out of scope for this image.
v1.5.34191.3 MB
Apps & productivitystandardMIT
D 1
floci-full
Opt-in, NON-hardened companion to the floci image: it runs as root and expects the host Docker socket mounted, which lets it emulate all 65 of Floci's AWS services including the 10 Docker-backed ones (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune). Same from-source Quarkus build and 0-CVE Trivy gate as floci, but running root with a mounted /var/run/docker.sock is a node-root / container-escape surface, so use it only in trusted single-tenant dev or CI. The floci Helm chart selects this image via mode=full behind an explicit acknowledgeRisk gate. Image only, no separate chart.
v1.5.29190.8 MB
Apps & productivitystandardMIT
A+
Fluent Bit
Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends.
v5.0.935.2 MB
ObservabilitystandardApache-2.0
C 2
forgejo
Self-hosted lightweight Git forge (a community Gitea fork) with issues, PRs, CI, and packages. From source with the web UI embedded (no Node at runtime), CGO+static-musl SQLite, on a hardened nonroot Wolfi base; data lives on a writable volume.
v15.0.368.6 MB
GitstandardGPL-3.0+
A+
Garage
Lightweight, S3-compatible object store for small, self-hosted, geo-distributed deployments that stays available across node failures. Licensed AGPL; runs well on modest hardware.
v2.3.029.7 MB3 versions
Object storagestandardAGPL-3.0
D 4
ghost
Open-source Node.js publishing platform for blogs, newsletters, and membership sites. Packaged from Ghost's official npm distribution on a hardened Wolfi Node 22; configured entirely via environment and backed by an external MySQL/MariaDB with a content PVC for themes, images, and data.
v6.54.1182.8 MB
Apps & productivitystandardMIT