Charts

140 charts

Hardened Helm charts

Each chart deploys our hardened image pinned by its signed digest, with sensible production defaults. Cosign-signed and published as an ArtifactHub verified publisher. 140 charts.

A+
MySQL
Widely used open-source relational database for general-purpose OLTP workloads, with broad framework and tooling support.
chart v · app v9.7.2
RelationalcriticalGPL-2.0
D 14
n8n
Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.
chart v · app v2.32.7
WorkflowstandardLicenseRef-n8n-Sustainable-Use-License-1.0
B 1
NATS
Lightweight, high-performance messaging system for cloud-native pub/sub and request-reply, with optional JetStream persistence and streaming.
chart v · app v2.14.4
MessagingstandardApache-2.0
B 1
navidrome
Self-hosted music server and streamer compatible with the Subsonic/OpenSubsonic API, with a modern web UI. From source (React UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; music and data on writable volumes.
chart v · app v0.62.0
Media & streamingstandardGPL-3.0
C 3
Neo4j
Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Community edition is GPLv3.
chart v · app v2026.05.0
GraphlowGPL-3.0
D 5
nextcloud
Nextcloud, the self-hosted file-sync and content-collaboration platform. Reconstructed clean-room on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs); the chart installs via occ and provides a MariaDB backend. Nextcloud is AGPL-3.0-only (strong copyleft).
chart v · app v34.0.2
Apps & productivitystandardAGPL-3.0
A+
nginx
High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends.
chart v · app v1.30.4
GatewaycriticalBSD-2-Clause
A+
nsq
Realtime distributed messaging platform. Ships nsqd, nsqlookupd, and nsqadmin as static Go binaries on a hardened nonroot Wolfi base; nsqd data path is a writable volume.
chart v · app v1.3.0
MessagingstandardMIT
B 1
ntfy
Simple HTTP-based pub-sub notification service for sending push notifications to phones and desktops from any script. From source with the web UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.
chart v · app v2.25.0
MessagingstandardApache-2.0
B 1
oauth2-proxy
Reverse-proxy authentication layer that secures upstream apps by delegating sign-in to OIDC and OAuth2 providers.
chart v · app v7.15.3
Secrets & identitystandardMIT
0 CVE
observability-stack
Hardened, operator-free observability stack: Prometheus + Grafana + Alertmanager + kube-state-metrics + node-exporter + cAdvisor, wired together for metrics, alerting, and populated Kubernetes dashboards.
chart v0.0.5 · app v1.0.0
StacksstandardUnknown
B 1
ollama
Local LLM runtime that pulls, runs, and serves open models (Llama, Gemma, Qwen, DeepSeek, and more) behind a simple REST API. CPU-only image; the chart mounts a writable volume for the model store.
chart v · app v0.32.5
Machine learning & AIstandardMIT