Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

D 9
mlflow
MLflow Tracking Server for the ML lifecycle — experiment tracking, model registry, and run metadata over a REST/UI on port 5000. Packaged as the lightweight mlflow-skinny stack (gunicorn + psycopg2 + boto3) on a hardened Wolfi python base; needs an external PostgreSQL backend store and an artifact store (S3 or PVC).
v3.15.0127.5 MB2 versions
Machine learning & AIstandardApache-2.0
C 1
MongoDB
Document (NoSQL) database for JSON-like data. SSPL is not OSI-approved / source-available, not open source; prefer the clean alternative FerretDB or DocumentDB.
v8.0.26171.9 MB3 versions
DocumentstandardSSPL-1.0
A+
mosquitto
Lightweight Eclipse MQTT broker for IoT and pub/sub messaging. Speaks MQTT 3.1/3.1.1/5.0 over TCP, TLS, and websockets; built from source with OpenSSL and a hardened nonroot, read-only-rootfs runtime.
v2.1.210.1 MB3 versions
MessagingstandardEPL-2.0 OR BSD-3-Clause
A+
MySQL
Widely used open-source relational database for general-purpose OLTP workloads, with broad framework and tooling support.
v9.7.2157.4 MB2 versions
RelationalcriticalGPL-2.0
D 14
n8n
Fair-code workflow automation platform — build integrations and automations across 400+ apps via a visual node editor, with native AI/LLM agent nodes. Node build on a hardened nonroot Wolfi base; the flagged transitive npm CVE class is cleared image-side with pinned overrides.
v2.32.7398.7 MB
WorkflowstandardLicenseRef-n8n-Sustainable-Use-License-1.0
D 17
n8n-runners
n8n external task-runner sidecar — isolates and executes workflow code (JS/Python) out of the main n8n process for security and scale. Built from source on Wolfi. Image only, no chart.
v2.32.7181.8 MB
WorkflowstandardLicenseRef-n8n-Sustainable-Use-License-1.0
B 1
NATS
Lightweight, high-performance messaging system for cloud-native pub/sub and request-reply, with optional JetStream persistence and streaming.
v2.14.46.6 MB3 versions
MessagingstandardApache-2.0
B 1
navidrome
Self-hosted music server and streamer compatible with the Subsonic/OpenSubsonic API, with a modern web UI. From source (React UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; music and data on writable volumes.
v0.62.022.2 MB
Media & streamingstandardGPL-3.0
C 3
Neo4j
Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads. Community edition is GPLv3.
v2026.05.0243.5 MB
GraphlowGPL-3.0
D 5
nextcloud
Nextcloud, the self-hosted file-sync and content-collaboration platform. Reconstructed clean-room on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs); the chart installs via occ and provides a MariaDB backend. Nextcloud is AGPL-3.0-only (strong copyleft).
v34.0.2436.7 MB
Apps & productivitystandardAGPL-3.0
A+
nginx
High-performance web server, reverse proxy, and load balancer for serving static content and fronting application backends.
v1.30.411.5 MB3 versions
GatewaycriticalBSD-2-Clause
D 14
node
Hardened Node.js runtime with npm, a 0-CVE signed nonroot base image for JavaScript apps. Active LTS lines (20/22/24).
v26.5.160.4 MB3 versions
Language runtimestandardMIT