Charts

140 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 140 charts.

A+
Fluent Bit
Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends.
chart v0.0.10 · app v5.0.9
ObservabilitystandardApache-2.0
C 2
forgejo
Self-hosted lightweight Git forge (a community Gitea fork) with issues, PRs, CI, and packages. From source with the web UI embedded (no Node at runtime), CGO+static-musl SQLite, on a hardened nonroot Wolfi base; data lives on a writable volume.
chart v0.0.6 · app v15.0.3
GitstandardGPL-3.0+
A+
Garage
Lightweight, S3-compatible object store for small, self-hosted, geo-distributed deployments that stays available across node failures. Licensed AGPL; runs well on modest hardware.
chart v0.0.10 · app v2.3.0
Object storagestandardAGPL-3.0
D 25
ghost
Open-source Node.js publishing platform for blogs, newsletters, and membership sites. Packaged from Ghost's official npm distribution on a hardened Wolfi Node 22; configured entirely via environment and backed by an external MySQL/MariaDB with a content PVC for themes, images, and data.
chart v0.0.10 · app v6.55.0
Apps & productivitystandardMIT
D 4
Gitea
Lightweight self-hosted Git service with repositories, issues, pull requests, and built-in CI/CD (Actions). A low-footprint GitHub alternative.
chart v0.0.14 · app v1.27.1
GitstandardMIT
B 1
gotify
Self-hosted server for sending and receiving real-time push messages over WebSocket, with a web UI and app tokens. From source (UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; data on a writable volume.
chart v0.0.6 · app v2.9.1
MessagingstandardMIT
0 CVE
Grafana
Hardened grafana image, built from source on Wolfi.
chart v0.0.11 · app v13.1.0
DatastorestandardUnknown
C 5
graylog
Graylog, the log-management and analysis server (search, dashboards, alerting, GELF/Beats inputs). Built clean-room on a hardened Wolfi JRE (nonroot, read-only rootfs); the chart provides MongoDB (metadata) and OpenSearch (log storage) backends. Graylog Server is SSPL-1.0 (source-available, not OSI-approved).
chart v0.0.6 · app v7.1.6
ObservabilitystandardSSPL-1.0
A+
HAProxy
High-performance TCP and HTTP load balancer and reverse proxy known for reliability and fine-grained traffic control at scale.
chart v0.0.10 · app v3.4.0
GatewaystandardGPL-2.0+
0 CVE
harbor
Hardened harbor image, built from source on Wolfi.
chart v0.0.14 · app v2.15.2
DatastorestandardUnknown
0 CVE
Harbor observability
Hardened harbor-observability image, built from source on Wolfi.
chart v0.0.8 · app v2.14.4
DatastorestandardUnknown
B 1
headscale
Open-source, self-hosted implementation of the Tailscale control server for coordinating a WireGuard mesh. Single static Go binary on a hardened nonroot Wolfi base; config and state on writable volumes.
chart v0.0.6 · app v0.29.2
Coordination & meshstandardBSD-3-Clause