Images

195 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 195 available now.

B 1
k6
Developer-friendly load and performance testing tool scripted in JavaScript. Single static Go binary on a hardened nonroot Wolfi base; test scripts are mounted at runtime.
v2.1.016.6 MB
ObservabilitystandardAGPL-3.0
A+
Kafka
Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing.
v4.3.1204.3 MB
MessagingcriticalApache-2.0
B 2
keda
Kubernetes event-driven autoscaler that scales workloads based on external event sources (queues, streams, metrics). Ships the operator and metrics adapter as static Go binaries on a hardened nonroot Wolfi base.
v2.20.179.8 MB
CoordinationstandardApache-2.0
A+
Keycloak
Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs.
v26.7.0231.6 MB
IdentitystandardApache-2.0
B 1
kube-state-metrics
Exposes the state of Kubernetes objects as Prometheus metrics for dashboards and alerts. Image only, no chart.
v2.19.118.2 MB3 versions
ObservabilitystandardApache-2.0
D 4
kubectl
Hardened kubectl image with the common cluster toolbelt (helm, kustomize, jq, a busybox shell) — the 0-CVE answer to alpine/k8s and bitnami/kubectl for CI jobs and in-cluster tooling. Image only, no chart.
v1.36.361.3 MB2 versions
CI/CD & registrystandardApache-2.0
B 2
kuma
CNCF service mesh control plane (Envoy-based) for multi-zone and multi-cluster meshes. Ships kuma-cp and kumactl with an embedded GUI, built from source on a hardened nonroot Wolfi base; default in-memory store runs standalone.
v2.14.062.5 MB
Coordination & meshstandardApache-2.0
D 12
kyverno
Kubernetes-native policy engine for validating, mutating, and generating resources with no new language. Ships the controllers and CLI as static Go binaries on a hardened nonroot Wolfi base.
v1.18.1253.3 MB
Security & supply chainstandardApache-2.0
B 1
litestream
Streaming replication for SQLite databases to object storage such as S3, GCS, and Azure. Image only, no chart.
v0.5.1516.9 MB
Storage & platformstandardApache-2.0
B 1
livekit
WebRTC SFU server for scalable real-time audio, video, and data. Single static Go binary on a hardened nonroot Wolfi base; config via mounted YAML or LIVEKIT_ env.
v1.13.418.0 MB
Media & streamingstandardApache-2.0
B 2
Loki
Horizontally scalable log aggregation system from Grafana that indexes only labels, not full log text. Like Prometheus, but for logs. Licensed AGPL.
v3.7.488.1 MB
ObservabilitystandardAGPL-3.0
B 1
mailpit
Email and SMTP testing tool with a web UI for capturing and inspecting messages during development. Image only, no chart.
v1.30.69.3 MB
Apps & productivitystandardMIT