What is shipped, what is next

Data exploration and business-intelligence dashboard platform backed by a metadata database and Redis.

Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE.

Opt-in, NON-hardened companion to the floci image: it runs as root and expects the host Docker socket mounted, which lets it emulate all 65 of Floci's AWS services including the 10 Docker-backed ones (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune).

Open-source Node.js publishing platform for blogs, newsletters, and membership sites.

Privacy-respecting web analytics platform on PHP backed by MySQL or MariaDB.

Nextcloud, the self-hosted file-sync and content-collaboration platform.

Self-hosted Git hosting with built-in pipelines from Harness.

The leading open-source automation server for building, testing, and deploying software, with thousands of plugins.

Centralized coordination service for distributed systems, providing configuration, naming, leader election, and synchronization primitives.

MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension.

Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads.

Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion for reverse proxies.

Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs.

Cloud-native identity and access management (IAM) with OIDC/OAuth2/SAML, multi-tenancy, and a built-in admin console.

Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing.

Cloud-native distributed messaging and streaming platform with multi-tenancy, geo-replication, and tiered storage that separates compute from storage.

Open-source, self-hosted team messaging and collaboration platform (a Slack alternative) with channels, direct messages, file sharing, and integrations.

Apache JMeter load-testing and performance-measurement tool, the official binary distribution running on a hardened Wolfi JRE.

APM: distributed tracing, metrics, and service-topology analysis. [blocked: upstream CVEs / ES9 unsupported]

Dashboards and visualization for metrics, logs, and traces across many data sources.

OpenTelemetry-based collector distribution for metrics, logs, traces, and profiles.

Graylog, the log-management and analysis server (search, dashboards, alerting, GELF/Beats inputs).

Kubernetes resource-metrics API for HPA and kubectl top.

Visualization and dashboards UI for OpenSearch.

Plugin-driven metrics collection agent from the InfluxData ecosystem.

Highly-available Prometheus setup with unlimited metric retention via object storage, adding a global query view, downsampling, and compaction across Prometheus servers.

Coolify helper image carrying the build and deploy toolchain (buildpacks, git, ssh) that runs on target hosts to execute deployments. [blocked: upstream CVEs / ES9 unsupported]

Distributed SQL database with PostgreSQL wire compatibility and automatic horizontal scaling and survivability.

Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections.

Distributed search and analytics engine.

Search and analytics suite with a Kibana-style dashboards UI.

OAuth 2.0 and OpenID Connect provider backed by a relational database.

Identity and user-management server for login, registration, and MFA.

Anchore's vulnerability scanner for container images and filesystems, driven by the same SBOM engine as Syft.

Fair-code workflow automation with native AI. Source-available, not OSI.

SBOM and component-vulnerability analysis platform backed by a relational database.

Enterprise PKI certificate authority (Community Edition) backed by a relational database.

OPA policy admission controller for Kubernetes.

LDAP directory server for centralized authentication and user data.

Authentication for Kubernetes clusters federating external identity providers.

Encrypts Kubernetes Secrets so they can be stored safely in Git.

CSI driver that mounts secrets from external stores (Vault, cloud KMS) as volumes.

SPIFFE runtime for issuing workload identities across a fleet.

Access plane providing identity-based SSH, Kubernetes, and database access. Community edition is AGPL-3.0.

HashiCorp Vault. Source-available, not OSI.

clean alt: OpenBao (MPL-2.0) — the open fork, already shipped.

Kubernetes configuration best-practice validation.

Proxy that translates between SAML and OIDC.

Dynamic API gateway on Nginx + LuaJIT: hot-reloads plugins and config from etcd, with no relational-database dependency. A high-performance Kong alternative.

Envoy-based Kubernetes ingress controller.

CNCF implementation of the Kubernetes Gateway API on Envoy: standard K8s resources instead of vendor CRDs. The Kubernetes-first Kong alternative.

Envoy-based gateway for microservices, monoliths, and serverless, with strong multi-protocol support: HTTP, gRPC, WebSockets, and FaaS.

Lightweight Eclipse Jetty servlet server.

API gateway on nginx/OpenResty. Open-core (the OSS gateway is Apache-2.0; many features are gated behind the enterprise tier) and it depends on PostgreSQL. APISIX and Tyk are lighter, fully-open alternatives.

Stateless high-performance API gateway.

Polyglot application server from the nginx team.

nginx + LuaJIT platform for scriptable web apps and gateways.

Caching and forwarding HTTP proxy.

HTTP caching reverse proxy and web accelerator.

JBoss Jakarta EE application server.

Tomcat plus the Jakarta EE stack.

Envoy-based Kubernetes API gateway / ingress.

High-performance Go AI gateway: unified access, load balancing, and failover across 20+ LLM providers with near-zero overhead. An open alternative to bolt-on AI-gateway plugins.

Lightweight Python proxy exposing one OpenAI-compatible API to call, monitor, and cost-map 100+ LLM providers.

Unified logging layer for collecting, parsing, and routing logs.

Visualization and dashboards for Elasticsearch. Default distribution is Elastic-2.0, not OSI.

clean alt: OpenSearch Dashboards (Apache-2.0) over OpenSearch, both open.

Server-side log and event processing pipeline. Default distribution is Elastic-2.0, not OSI.

clean alt: Vector (MPL-2.0) or Fluentd (Apache-2.0), both open pipelines.

Prometheus exporter for MongoDB metrics.

Prometheus exporter for MySQL/MariaDB metrics.

Real-time per-second infrastructure monitoring agent.

Kubernetes cost monitoring and allocation (CNCF).

Operator that manages OpenTelemetry Collector instances and auto-instrumentation.

Percona Monitoring and Management — deep MySQL/PostgreSQL/MongoDB observability (query analytics) built on Prometheus, Grafana and VictoriaMetrics. AGPL, OSI-approved.

Loki's agent for shipping pod and file logs.

Self-hosted uptime and status-page monitor.

Infrastructure and network monitoring platform; version 7 and later is AGPL-3.0.

Distributed tracing system for collecting and querying timing data.

Horizontally scalable, multi-tenant Prometheus storage.

Prometheus exporter for Kafka lag and topic metrics.

Scalable vector database for AI workloads.

Agentless IT automation and configuration management.

Real-time analytics database for high-concurrency OLAP queries.

Stateful stream processing.

Visual dataflow automation for routing, transforming, and mediating data.

Real-time distributed OLAP datastore for low-latency analytics.

Unified batch and stream analytics engine.

Process automation and BPMN orchestration including the Zeebe engine.

Data orchestrator for ML and analytics pipelines.

Python-native workflow orchestration server for data pipelines.

Distributed SQL query engine for federated analytics across data sources.

Feature-flag and toggle management server backed by PostgreSQL.

HTTP API mock server for testing.

Kubernetes-native integration framework.

Open REST catalog for Apache Iceberg tables.

Content and metadata extraction toolkit.

Semantic layer and analytics API over your data.

Permissioned enterprise blockchain platform.

Web UI to manage and browse Kafka — the console the messaging-stack needs.

Java JMS message broker, including the Artemis next-generation engine.

API and schema registry for Kafka, Avro, and Protobuf.

Open schema registry and REST proxy for Kafka; an Apache-licensed alternative to the Confluent Community schema-registry.

Kafka-compatible streaming. Source-available, not OSI.

clean alt: Kafka or Pulsar (Apache-2.0), both already shipped.

Kubernetes operator for running and managing Kafka.

Distributed real-time stream processing.

eBPF/iptables CNI for networking and network policy.

eBPF-based networking, security, and observability for Kubernetes.

Service discovery and mesh. Source-available, not OSI.

clean alt: etcd (Apache-2.0) for KV/coordination, already shipped.

Service mesh built on Envoy: traffic management, mTLS, and observability. Platform-scale, a multi-image wave (istiod control plane plus Envoy sidecars and gateways) rather than a single image.

Lightweight service mesh.

Load-balancer implementation for bare-metal Kubernetes clusters.

Workload scheduler. Source-available, not OSI.

Authoritative DNS server and recursor with database backends.

Validating, recursive, caching DNS resolver.

Authoritative and recursive DNS server.

Internet routing protocol suite (BGP, OSPF, etc.).

Virtual IP and load balancer for the control plane and services.

WireGuard-based mesh VPN with a Kubernetes operator.

Redis-protocol key-value database persisted on RocksDB.

Transactional catalog and versioning for data lakehouse tables.

Multi-model database for documents, graphs, and key-value (Community Edition).

Kubernetes operator for PostgreSQL HA: streaming replication, automated failover, and backups/PITR to object storage, all via CRDs. CNCF project; the modern operator behind the pg-ha-stack.

Distributed SQL database for time-series and search.

Versioned SQL database migrations.

Instant GraphQL API over PostgreSQL and other databases.

Distributed graph database over pluggable storage backends.

Multi-threaded Redis fork; BSD-licensed and Redis-protocol compatible.

Database schema change and migration management.

Kubernetes operator for MariaDB/MySQL: provisioning, Galera multi-primary HA, replication, backups, and user/grant management via CRDs.

MongoDB Community Kubernetes Operator: replica-set HA, automated failover, and TLS via CRDs. The operator is Apache-2.0; note the MongoDB server it deploys is SSPL (not OSI).

Operator for Percona XtraDB Cluster (MySQL): synchronous multi-primary HA via Galera, with automated backups and point-in-time recovery.

Connection pooling, load balancing, and replication middleware for PostgreSQL.

PostgreSQL with the pgvector extension for vector similarity search.

High-performance proxy for MySQL/MariaDB.

Realtime document database with live queries.

Multi-model database. Source-available, not OSI.

Horizontal sharding for MySQL.

Real-time key-value database; community edition is AGPL.

Distributed document database. Source-available, not OSI.

clean alt: CouchDB (Apache-2.0), already shipped.

Multi-model graph and document database.

Modern Redis/Valkey desktop GUI (Wails/Go+Vue). A desktop client, not a deployable server, so it falls outside the hardened in-cluster image model — a web Redis UI (e.g. redis-commander) would be the cache-stack UI instead.

Scalable distributed object store (S3 + HDFS).

Self-hostable PaaS on Docker Swarm. Open-core: most is Apache-2.0, the /proprietary parts are source-available (DSAL-1.0). Not a fit for the hardened catalog: it requires root, the Docker socket, and an initialized Swarm, so it cannot run nonroot or read-only.

clean alt: Coolify (Apache-2.0), already shipped.

Reference IPFS implementation for distributed content-addressed storage.

Distributed block storage for Kubernetes with snapshots and backups.

S3-compatible object storage; relicensed to AGPL-3.0.

clean alt: SeaweedFS / Garage / RustFS (Apache-2.0), all already shipped.

Continuous code-quality and security inspection.

Simple container-native CI engine.

Ceph storage orchestrator for Kubernetes (block/object/file).

S3-compatible gateway fronting any storage backend.

Low-code internal-tools and admin-panel builder backed by PostgreSQL and Redis.

Ruby discussion and forum platform backed by PostgreSQL and Redis.

Stateless HTML and Office to PDF conversion API.

Self-hosted spreadsheet-database hybrid, an Airtable alternative.

Self-hosted services and bookmarks dashboard with widget integrations.

PHP CMS backed by MySQL or MariaDB.

Federated social network server (Ruby plus Node) backed by PostgreSQL and Redis.

The wiki engine behind Wikipedia, backed by MySQL or MariaDB.

Friendly self-service BI and analytics dashboards.

PHP learning management system backed by MySQL, MariaDB, or PostgreSQL.

Python ERP and business apps suite (Community Edition) backed by PostgreSQL.

Web administration and management UI for PostgreSQL.

PHP web administration UI for MySQL and MariaDB.

Ruby on Rails project management and issue tracker backed by a relational database.

Self-hosted team chat platform backed by MongoDB.

PHP customer relationship management application backed by MySQL or MariaDB.

Drupal fork focused on simplicity, backed by MySQL.

Headless browser for rendering, scraping, and PDF export.

Federated social network server.

Web administration UI for MongoDB.

Python enterprise CMS on Zope.

Distributed browser automation and testing grid.

Enterprise wiki and structured collaboration platform.

Self-hosted URL shortener.

Clientless remote desktop gateway for RDP, VNC, and SSH over the browser.

Self-hosted media server for movies, music, and live TV.

Declarative GitOps continuous delivery for Kubernetes.

Event-driven workflow automation for Kubernetes.

Progressive delivery (canary, blue-green) for Kubernetes.

Pipeline-based continuous integration system backed by PostgreSQL.

Control-plane framework for managing cloud infrastructure via Kubernetes APIs.

Distributed application runtime providing building-block APIs for microservices.

GitOps toolkit of controllers for continuous delivery on Kubernetes.

Self-hosted Actions runner — the runner the gitops-stack needs for a Gitea/Forgejo backend.

CI job executor for GitLab pipelines; also a gitops-stack runner option.

The original minimal Go Git service that Gitea forked from. Very small single-binary forge; an even lighter gitops-stack backend option.

Jenkins JNLP inbound build agent. Image only, no chart. Build held: jenkins-docker-agent carries a CRITICAL jetty CVE (fix 2.560-r0 not yet in Wolfi).

Private Terraform/OpenTofu registry for modules and providers (Go). Hardenable as a normal nonroot server image; unlocks the gitops-stack and registry-stack.

Virtual Kubernetes clusters inside a namespace.

Scales Kubernetes node pools to match pending workloads.

Full DevOps platform (Git forge + CI/CD + registry). Heavy fit: a large Ruby monolith that bundles PostgreSQL, Redis, Gitaly, Sidekiq and Workhorse, and the gitlab-org/gitlab repo is mostly EE-proprietary — only the CE-flagged code is MIT. Far from the minimal one-purpose hardened model.

clean alt: Gitea or Forgejo — lightweight, fully-open Git forges that drop straight into the gitops-stack.

Run virtual machines as Kubernetes workloads.

Safe automated node reboots for Kubernetes.

Self-hosted Git server with built-in CI/CD, issues and kanban (Java). Heavier than Gitea/Gogs but far lighter than GitLab; an all-in-one gitops-stack backend option.

Rolls workloads when their ConfigMaps or Secrets change.

Thin Terraform/OpenTofu wrapper for DRY configurations.

Recommends and applies pod CPU/memory requests.

Multi-user Jupyter notebook server for teams and classrooms.

Kubernetes model inference serving with autoscaling.

Operator for running Ray distributed-compute clusters on Kubernetes.

Data-labeling and annotation tool for ML datasets.

Visual builder for LLM applications and agent workflows.

LLM observability and tracing platform backed by PostgreSQL.

Self-hosted web UI for chatting with local and remote LLMs.

Self-hosted chat-with-your-documents LLM application.

Metadata platform and data catalog.

ML pipeline orchestration on Kubernetes.

High-performance serving system for TensorFlow models.

Daemonless OCI image builder.

Concurrent container image build engine.

Static security scanning for Terraform, Kubernetes, and more.

Open-source antivirus engine for scanning files and mail.

go-containerregistry CLI for registry interaction.

Programmable CI/CD engine that runs pipelines in containers.

Runtime security and threat detection using kernel and eBPF events.

Secret scanner for git repos and files.

Dockerfile linter.

Build container images inside Kubernetes without a daemon.

Kubernetes security, posture, and compliance scanner.

In-cluster Kubescape components (operator, scanner, kubevuln) for continuous posture and vulnerability scanning. Distinct from the Kubescape CLI.

Notary v2 OCI artifact signing and verification.

Push and pull arbitrary artifacts to OCI registries.

Daemonless container engine and Docker CLI replacement.

Shell script static analysis linter.

Keyless signing infrastructure including Fulcio CA and the Rekor transparency log.

Inspect and copy container images between registries.

eBPF-based runtime security observability and enforcement.

In-cluster continuous Trivy scanning via CRDs.

SIEM and XDR platform with manager, indexer, and dashboard components.

Admission controller enforcing image signature verification.

Explore container image layers and wasted space.

Build and deploy Go container images with no Dockerfile.

SCAP compliance and vulnerability scanning.

Deep secret scanner across repos and filesystems.

Umbrella: Valkey + redis-exporter + Grafana dashboards — cache with metrics. All components built; ready to build.

Umbrella: PostgreSQL + PgBouncer + postgres-exporter — pooled SQL with metrics. All components built; ready to build.

Umbrella: OpenBao + Keycloak — SSO in front of secrets management. All components built; ready to build.

Ollama (or vLLM) + Open WebUI + Qdrant — self-hosted LLM serving, a chat UI, and a vector DB for retrieval-augmented generation. Qdrant is built; needs Ollama/vLLM + Open WebUI images.

Apache Superset + Trino + PostgreSQL — federated SQL analytics with self-service BI dashboards. PostgreSQL is built; needs Superset + Trino.

Velero + MinIO — scheduled cluster backup/restore and PV snapshots to an in-cluster S3 target. Needs Velero + MinIO images.

clean alt: Use any external S3 (SeaweedFS/Garage, already shipped) instead of MinIO to keep it fully Apache-2.0.

OpenCost + Prometheus + Grafana — Kubernetes cost monitoring and allocation dashboards; an add-on to the observability stack. Prometheus + Grafana are built; needs OpenCost.

Umbrella: a pluggable Git backend + Atlantis + Terralist for Terraform/OpenTofu GitOps with a private module/provider registry. Pick your forge: Gitea (default, built) or Forgejo / Gogs (lightweight, clean) / OneDev (all-in-one) / GitLab CE (heavy, mixed license). Atlantis + Gitea charts built; needs a Terralist image, the chosen forge's image, and a runner — GitHub Actions Runner or GitLab Runner, both now on the roadmap (or run runner-less).

Traefik (or ingress-nginx) + cert-manager + external-dns — production ingress with automatic TLS and DNS records. Traefik + external-dns are built; needs cert-manager.

Trino + Apache Nessie (or Polaris) + MinIO — an Iceberg data lakehouse: query engine, versioned table catalog, and object store. Needs those images.

Umbrella: Kafka + ZooKeeper (or NATS) + a console UI — event backbone. Needs a Kafka UI image first — AKHQ (Apache-2.0) is now on the roadmap for exactly this.

Operator-based HA MongoDB: MongoDB Community Operator + a metrics exporter — replica-set failover. CRD-driven. The operator is Apache-2.0, but MongoDB itself is SSPL (not OSI), so the stack inherits that caution.

clean alt: FerretDB (Apache-2.0) on the pg-ha-stack — a MongoDB-compatible, fully-open document database over PostgreSQL.

Operator-based HA MySQL: a MySQL operator (Percona XtraDB Cluster, or MariaDB Operator with Galera) + a metrics exporter — synchronous multi-primary replication and backups. CRD-driven. Needs the chosen operator image first.

Apache Airflow + PostgreSQL + Valkey — data-pipeline scheduling (Airflow needs a metadata DB and a broker). PostgreSQL + Valkey are built; needs Airflow.

Operator-based HA PostgreSQL: CloudNativePG + PgBouncer + postgres-exporter — streaming replication, automated failover, and backups/PITR to object storage. NOTE: unlike the operator-free observability stacks, this is CRD-driven (it installs the CloudNativePG operator). Needs a CloudNativePG image first.

step-ca + cert-manager + trust-manager — an internal certificate authority with automated issuance and cluster-wide trust-bundle distribution. Needs those images.

Kyverno + Policy Reporter + Polaris (Fairwinds) — Kubernetes policy enforcement, violation reporting, and configuration best-practice validation. Operator-light (admission webhooks). Needs those images.

Grafana Pyroscope + Grafana — continuous CPU/memory profiling; the missing 'P' that completes LGTM(P) alongside the observability/logging/tracing stacks. Needs a Pyroscope image.

Umbrella: Harbor (container images + OCI Helm charts + Trivy scanning) + Terralist (Terraform/OpenTofu modules & providers) — one self-hosted artifact registry for every kind of artifact. Harbor chart built; needs a Terralist image+chart.

Falco + Tetragon — eBPF-based runtime threat detection and enforcement. Privileged host/kernel access by design (like node-exporter). Needs those images.

Umbrella: OpenSearch + OpenSearch Dashboards — search with a UI. Needs an opensearch-dashboards image first.

Kafka + Apache Flink + Apicurio Registry — end-to-end stream processing with schema governance. Kafka is built; needs Flink + Apicurio.

Trivy Operator + Kubescape + Dependency-Track — continuous image, cluster-posture, and SBOM vulnerability scanning in one place. Needs those images.

Umbrella: Temporal + Elasticsearch for advanced visibility. Marginal — the Temporal chart already bundles its own PostgreSQL, so a stack only adds optional ES visibility search.