Images

435 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 435 available now.

A+
DocumentDB
Self-contained MongoDB-compatible server bundling PostgreSQL, the DocumentDB extension, and a wire gateway. Linux Foundation project, truly open…
v1.0.092.0 MB3 versions
DocumentstandardMIT
D 2
dotnet
Hardened .NET SDK for building and running .NET apps. Use as a build base; ships the current LTS line (10). Image only, no chart.
v10.0.114253.7 MB
Language runtimestandardMIT
D 2
dotnet-runtime
Hardened .NET runtime for console and worker apps, no SDK. Build on the dotnet image, then run here. Lines 8/9/10.
v10.0.11461.9 MB2 versions
Runtime basestandardMIT
A+
Dragonfly
Multi-threaded, Redis- and Memcached-compatible in-memory datastore built to scale vertically on one node. BUSL is source-available, not open source;…
v2.123.6 MB4 versions
CachelowBUSL-1.1
D 5
drupal
Drupal core, the open-source CMS and content framework. Built from the official release tarball on a hardened Wolfi php-8.4-fpm + nginx runtime…
v11.4.1271.0 MB
Apps & productivitystandardGPL-2.0+
A+
duckdb
In-process analytical SQL database CLI, shipped from upstream's official precompiled binary. Image only, no chart.
v2.0.029.2 MB4 versions
Databases & enginesstandardMIT
A 2
easegress
Easegress, the Go traffic orchestration gateway (HTTP/1-3 proxy, filters and pipelines, embedded etcd for clustering), with the egctl admin client.…
v2.11.053.4 MB3 versions
GatewaystandardApache-2.0
A+
Elasticsearch
Distributed search and analytics engine. Shipped under SSPL/Elastic License, which are not OSI-approved; OpenSearch (Apache-2.0) is the open drop-in…
v9.5.6658.5 MB
SearchlowSSPL-1.0
A+
elixir
Hardened Elixir runtime on the BEAM VM, built on Erlang/OTP, for concurrent, fault-tolerant apps (e.g. Phoenix). Latest stable (1.18).
v1.19.569.7 MB3 versions
Language runtimestandardApache-2.0
Held
emissary
Emissary-ingress, the CNCF Kubernetes API gateway built on Envoy (Mapping, Host and Listener CRDs, auth, rate limiting, canaries). Envoy 1.37 from…
v4.1.089.3 MB
GatewaystandardApache-2.0
C 1
emissary-apiext
Emissary-ingress apiext, the conversion webhook that serves the getambassador.io CRD versions (v2 and v3alpha1) and patches the CRDs with its CA.…
v4.1.016.5 MB
GatewaystandardApache-2.0
A+
emqx
Massively scalable, distributed MQTT broker for IoT, IIoT, and connected vehicles. Speaks MQTT 5.0 over TCP/TLS/websockets with a clustering engine…
v6.3.2132.2 MB
MessagingstandardBUSL-1.1