Docs

Short, practical guides for using the catalog. Install something, check that you can trust it, pin it, and tune it.

0 fixable CVEs

A hard Trivy gate; a fixable CVE fails the build, so nothing ships dirty.

Built from source

Compiled on Wolfi with melange + apko. No Dockerfile, nothing inherited.

Nonroot, read-only

uid 1001, read-only root filesystem, all capabilities dropped.

Multi-arch

linux/amd64 + linux/arm64, one signed index.

Signed

cosign keyless, tied to the build workflow and logged in Rekor.

Pinned by digest

Charts reference images by sha256, never a moving tag.

Guides

Install a chart and pull an image. No repo to add, no account needed.

Check an image or chart with cosign. Keyless, tied to the build workflow.

Run exactly what was scanned and signed, with no moving tag.

The shared values surface every chart exposes through quench-common.

What is OSI-clean, what is source-available, and the alternatives we recommend.

Looking for a specific datastore? Browse all charts or all images.