Qué está publicado, qué sigue

Plataforma de exploración de datos y paneles de inteligencia de negocio respaldada por una base de datos de metadatos y Redis.

Interfaz de visualización y paneles para OpenSearch.

Base de datos vectorial escalable para cargas de trabajo de IA.

Almacén de datos OLAP distribuido en tiempo real para analítica de baja latencia.

Motor unificado de analítica por lotes y en streaming.

Automatización de procesos y orquestación BPMN, incluido el motor Zeebe.

Kubernetes-native integration framework.

Base de datos de analítica en tiempo real para consultas OLAP de alta concurrencia.

Open REST catalog for Apache Iceberg tables.

Semantic layer and analytics API over your data.

Permissioned enterprise blockchain platform.

API and schema registry for Kafka, Avro, and Protobuf. Measured 2026-09-25: the 3.3.3 app distribution carries 467 findings; 26 in-place jar swaps clear all but opentelemetry-api 1.57.0 (CVE-2026-45292, fixed only in 1.62.0), which adds packages the prebuilt Quarkus index cannot load. Needs a source build that regenerates the index.

Streaming compatible con Kafka. De código disponible, no OSI.

alt. limpia: Kafka or Pulsar (Apache-2.0), both already shipped.

Kubernetes operator for running and managing Kafka. Sized 2026-09-25: two from-source images, the operator (a Maven multi-module build; the release ships only install YAML) and Strimzi's own Kafka image, whose run scripts and agents the operator drives; the QuenchWorks kafka image does not have that layout. Measured 2026-09-29: Wolfi packages Strimzi too (strimzi-kafka-operator with kafka-strimzi-compat), but at 1.0.0-r4 against upstream 1.2.0, and that stack scans at 849 fixable findings (59 critical, 353 high), including jackson-databind 2.21.2 and the JMX exporter; so it still needs the from-source build.

Distributed real-time stream processing.

eBPF/iptables CNI for networking and network policy.

Cilium's own patched Envoy; not reusable from our stock envoy image.

Descubrimiento de servicios y malla. De código disponible, no OSI.

alt. limpia: Kuma (Apache-2.0) -- already shipped; or Linkerd / Istio.

Envoy-based sidecar for Consul. MPL, so cleaner than the BUSL server.

The operator that makes Consul work on Kubernetes.

Malla de servicios construida sobre Envoy: gestión de tráfico, mTLS y observabilidad. A escala de plataforma, una oleada de varias imágenes (plano de control istiod más sidecars y pasarelas de Envoy) en lugar de una sola imagen.

Privileged node agent; hostPath + privileged. Needs the node-agent exception tier.

Rust node proxy for Istio ambient mode. Skip if we ship sidecar mode only.

Privileged node agent (alternative to proxy-init). Needs the node-agent exception tier.

Observability extension: metrics-api, tap, tap-injector, web. Ship only if dashboard parity is wanted.

Planificador de cargas de trabajo. De código disponible, no OSI.

Operator for Percona XtraDB Cluster (MySQL): synchronous multi-primary HA via Galera, with automated backups and point-in-time recovery. Image SHIPPED 2026-09-27 (1.18.0, 1.19.1, 1.20.0; it is also the pods' init image). Chart HELD: in the kind gate the operator creates the cluster and its init containers complete, but the Percona 8.4.8 database pod starts mysqld with wsrep provider none and never becomes ready, and it does the same with upstream's init image and with the 8.0 database image. Percona's forum reports the same failure in kind and minikube on Linux; the chart waits for a gate on a non-kind cluster.

Base de datos multimodelo para documentos, grafos y clave-valor (Community Edition).

Database schema change and migration management. Relicensed: 5.x is under the Functional Source License 1.1 (source-available, Apache-2.0 two years after each release, competing use restricted); the last Apache-2.0 release is 4.33.0 and its line is no longer patched. Flyway (Apache-2.0) covers the same job.

MongoDB Community Kubernetes Operator: replica-set HA, automated failover, and TLS via CRDs. The operator is Apache-2.0; note the MongoDB server it deploys is SSPL (not OSI). Held 2026-10-07: the community operator repo is archived; its successor mongodb/mongodb-kubernetes (1.13.0, Apache-2.0 for Community clusters) runs every member beside mongodb-agent, a closed-source binary its Dockerfile downloads prebuilt (agent 109.0.1.9310-1), which cannot be built or scanned.

Base de datos multimodelo. De código disponible, no OSI.

Real-time key-value database; community edition is AGPL.

Distributed document database. Source-available, not OSI.

alt. limpia: CouchDB (Apache-2.0), already shipped.

Base de datos de grafos distribuida sobre backends de almacenamiento intercambiables.

Fork multihilo de Redis; con licencia BSD y compatible con el protocolo de Redis.

Multi-model graph and document database.

Modern Redis/Valkey desktop GUI (Wails/Go+Vue). A desktop client, not a deployable server, so it falls outside the hardened in-cluster image model — a web Redis UI (e.g. redis-commander) would be the cache-stack UI instead.

Almacén de objetos distribuido escalable (S3 + HDFS).

PaaS autoalojable sobre Docker Swarm. Open-core: la mayor parte es Apache-2.0, las partes /proprietary son de código disponible (DSAL-1.0). No encaja en el catálogo endurecido: requiere root, el socket de Docker y un Swarm inicializado, por lo que no puede ejecutarse como nonroot ni en modo de solo lectura.

alt. limpia: Coolify (Apache-2.0), already shipped.

S3-compatible object storage; relicensed to AGPL-3.0.

alt. limpia: SeaweedFS / Garage / RustFS (Apache-2.0), all already shipped.

Inspección continua de calidad y seguridad del código.

Ceph storage orchestrator for Kubernetes (block/object/file).

Constructor low-code de herramientas internas y paneles de administración respaldado por PostgreSQL y Redis.

Plataforma de debate y foros en Ruby respaldada por PostgreSQL y Redis.

API sin estado de conversión de HTML y Office a PDF.

Self-hosted spreadsheet-database hybrid, an Airtable alternative. Sized 2026-09-25: a Node build plus the Python 3.11 formula sandbox (gVisor or Pyodide); larger than the controller queue ahead of it.

Sistema de gestión del aprendizaje en PHP respaldado por MySQL, MariaDB o PostgreSQL.

Self-hosted team chat platform backed by MongoDB.

Aplicación de gestión de relaciones con clientes en PHP respaldada por MySQL o MariaDB.

Drupal fork focused on simplicity, backed by MySQL.

Headless browser for rendering, scraping, and PDF export.

Federated social network server.

Python enterprise CMS on Zope.

Distributed browser automation and testing grid.

Enterprise wiki and structured collaboration platform.

Servidor multimedia autoalojado para películas, música y TV en directo.

Sistema de integración continua basado en pipelines respaldado por PostgreSQL.

Full DevOps platform (Git forge + CI/CD + registry). Heavy fit: a large Ruby monolith that bundles PostgreSQL, Redis, Gitaly, Sidekiq and Workhorse, and the gitlab-org/gitlab repo is mostly EE-proprietary — only the CE-flagged code is MIT. Far from the minimal one-purpose hardened model.

alt. limpia: Gitea or Forgejo — lightweight, fully-open Git forges that drop straight into the gitops-stack.

Run virtual machines as Kubernetes workloads.

Self-hosted Git server with built-in CI/CD, issues and kanban (Java). Heavier than Gitea/Gogs but far lighter than GitLab; an all-in-one gitops-stack backend option. Measured 2026-10-07 at 16.8.5 (47 findings): jackson-databind/core 2.22.2 in lib/ swap cleanly, but Hazelcast 5.7.0 (its newest release) relocates jackson 2.21.2 and tools.jackson 3.1.2 under com/hazelcast/shaded/, which needs a bytecode relocation rewrite or a Hazelcast release; logback 1.4.14 needs the 1.5 line; boot/ ships prebuilt Tanuki wrapper binaries.

Constructor visual de aplicaciones de LLM y flujos de trabajo de agentes.

Plataforma de observabilidad y trazabilidad de LLM respaldada por PostgreSQL.

Interfaz web autoalojada para chatear con LLM locales y remotos.

Self-hosted chat-with-your-documents LLM application.

Metadata platform and data catalog.

ML pipeline orchestration on Kubernetes.

High-performance serving system for TensorFlow models.

Visualización y paneles para Elasticsearch. La distribución por defecto es Elastic-2.0, no OSI.

alt. limpia: OpenSearch Dashboards (Apache-2.0) over OpenSearch, both open.

Pipeline de procesamiento de logs y eventos del lado del servidor. La distribución por defecto es Elastic-2.0, no OSI.

alt. limpia: Vector (MPL-2.0) or Fluentd (Apache-2.0), both open pipelines.

Real-time per-second infrastructure monitoring agent.

Percona Monitoring and Management — deep MySQL/PostgreSQL/MongoDB observability (query analytics) built on Prometheus, Grafana and VictoriaMetrics. AGPL, OSI-approved.

Horizontally scalable, multi-tenant Prometheus storage. Held 2026-10-05: four prometheus/prometheus CVEs (two HIGH) are fixed only in 0.311.3 (Prometheus 3.11.3), but Cortex 1.21.1 is on 0.308.1 and imports tsdb/errors, removed in Prometheus 3.10; Cortex master is on 0.309.1 and still imports it. Unblocks when a Cortex release moves to Prometheus 3.11.

Autoridad certificadora de PKI empresarial (Community Edition) respaldada por una base de datos relacional.

Plano de acceso que proporciona acceso basado en identidad a SSH, Kubernetes y bases de datos. La edición community es AGPL-3.0.

Proxy that translates between SAML and OIDC.

CSI driver that mounts secrets from external stores (Vault, cloud KMS) as volumes. Held 2026-09-25: a CSI node plugin runs privileged with bidirectional mount propagation on hostPath, so it waits on the node-agent exception tier with Linkerd CNI and Istio CNI.

Programmable CI/CD engine that runs pipelines in containers. Sized 2026-09-27: the CLI is plain Go, but the engine image bundles runc, CNI plugins and the Go, Python and TypeScript SDK runtimes as builtin content that upstream builds with Dagger itself. A multi-day build; not started.

Seguridad en tiempo de ejecución y detección de amenazas usando eventos del kernel y eBPF.

Kubernetes security, posture, and compliance scanner. Blocked 2026-09-25: 4.0.14 links github.com/docker/docker v28.5.2 (CVE-2026-33997, fixed only in moby 29.3.1, unreachable from the +incompatible module) through armosec/armoapi-go, whose newest v0.0.763 still requires it.

In-cluster Kubescape components (operator, scanner, kubevuln) for continuous posture and vulnerability scanning. Distinct from the Kubescape CLI.

Plataforma SIEM y XDR con componentes de manager, indexador y panel.

Build container images inside Kubernetes without a daemon. Held 2026-09-25: Google archived it in June 2025 (continued as osscontainertools/kaniko 1.28 and chainguard-dev/kaniko 1.25), and the executor unpacks image layers over its own root filesystem, so it must run as root, against the nonroot rule. BuildKit rootless is the likelier fit.

Deep secret scanner across repos and filesystems.

Ollama (or vLLM) + Open WebUI + Qdrant — self-hosted LLM serving, a chat UI, and a vector DB for retrieval-augmented generation. Qdrant is built; needs Ollama/vLLM + Open WebUI images.

Apache Superset + Trino + PostgreSQL — federated SQL analytics with self-service BI dashboards. PostgreSQL is built; needs Superset + Trino.

OpenCost + Prometheus + Grafana — Kubernetes cost monitoring and allocation dashboards; an add-on to the observability stack. Prometheus + Grafana are built; needs OpenCost.

Operator-based HA MongoDB: MongoDB Community Operator + a metrics exporter — replica-set failover. CRD-driven. The operator is Apache-2.0, but MongoDB itself is SSPL (not OSI), so the stack inherits that caution.

alt. limpia: FerretDB (Apache-2.0) on the pg-ha-stack — a MongoDB-compatible, fully-open document database over PostgreSQL.

Apache Airflow + PostgreSQL + Valkey — data-pipeline scheduling (Airflow needs a metadata DB and a broker). PostgreSQL + Valkey are built; needs Airflow.

Falco + Tetragon — eBPF-based runtime threat detection and enforcement. Privileged host/kernel access by design (like node-exporter). Needs those images.

Umbrella: OpenSearch + OpenSearch Dashboards — search with a UI. Held 2026-10-07: chart built and gated (OpenSearch document found through Dashboards), but it bundles the opensearch-dashboards image, which is held (see that entry).

Java API gateway. shenyu-bootstrap + shenyu-admin; admin needs a database.

Web UI for APISIX (Go API + Vue frontend). Confirm upstream is still maintained before building; the gateway ships without it.

Java + Angular, 3 components (gateway, management-api, management-ui), needs MongoDB or JDBC plus Elasticsearch. Heaviest gateway in the wave.

Alibaba's Istio+Envoy-based gateway. Two components (higress-core, higress-console) and it inherits Istio/Envoy build weight.

Zalando's HTTP router. BLOCKING: GitHub reports NOASSERTION and the LICENSE fetch came back empty -- resolve the license before writing a recipe.

Tomcat plus the Jakarta EE stack.