Images

195 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 195 available now.

D 4
Harbor registryctl
Harbor registry controller that manages garbage collection and registry storage lifecycle operations alongside the registry backend.
v2.15.213.0 MB
RegistrystandardApache-2.0
D 3
Harbor trivy-adapter
Harbor vulnerability-scan adapter backed by Trivy, scanning pushed images for CVEs and reporting results into Harbor.
v2.15.280.0 MB
RegistrystandardApache-2.0
B 1
headscale
Open-source, self-hosted implementation of the Tailscale control server for coordinating a WireGuard mesh. Single static Go binary on a hardened nonroot Wolfi base; config and state on writable volumes.
v0.29.219.9 MB
Coordination & meshstandardBSD-3-Clause
A+
httpd
Apache HTTP Server, the long-standing open-source web server and reverse proxy for serving static content and fronting application backends (mod_proxy).
v2.4.6834.5 MB
GatewaycriticalApache-2.0
C 2
InfluxDB
Time-series database purpose-built for ingesting and querying metrics, events, and IoT/sensor data at high write rates.
v2.9.155.2 MB
Time seriesstandardMIT
D 5
ingress-nginx
The Kubernetes NGINX Ingress Controller. Routes external HTTP/HTTPS traffic to in-cluster Services via Ingress resources, with TLS termination, path/host routing, and an admission webhook. The chart wires its RBAC, IngressClass, and webhook.
v1.15.879.8 MB
GatewaystandardApache-2.0
B 1
jaeger
Distributed tracing platform (Jaeger v2, OpenTelemetry-collector based) with an embedded query UI. From source on a hardened nonroot Wolfi base; in-memory storage by default, badger under a volume.
v2.19.028.1 MB
ObservabilitystandardApache-2.0
A+
jdk
Hardened OpenJDK with the javac compiler, a build-stage base image to FROM for Java apps. LTS lines 17/21/25.
v25.0.4112.1 MB3 versions
Language runtimestandardGPL-2.0-with-classpath-exception
C 1
jenkins
The leading open-source automation server for building, testing, and deploying software, with thousands of plugins. Ships the architecture-independent jenkins.war LTS line on a hardened Wolfi JRE.
v2.572171.4 MB
CI/CD & registrystandardMIT
0 CVE
jenkins-inbound-agent
Jenkins inbound (JNLP/websocket) build agent — the remoting agent.jar plus launch script on a hardened Wolfi JRE, connecting back to a Jenkins controller to run builds. Image only, no chart.
CI/CD & registrystandardMIT
A+
jmeter
Apache JMeter load-testing and performance-measurement tool, the official binary distribution running on a hardened Wolfi JRE. Image only, no chart.
v5.6.3140.2 MB
ObservabilitystandardApache-2.0
A+
jre
Hardened Java runtime (JRE) for running a built jar, no compiler. Pair with the jdk, maven, or gradle build image. LTS lines 17/21/25.
v25.0.483.2 MB3 versions
Runtime basestandardGPL-2.0-with-classpath-exception