Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

B 1
node-exporter
Prometheus exporter for host-level hardware and OS metrics (CPU, memory, disk, network) on Linux machines.
v1.12.16.5 MB
Metrics/ExporterstandardApache-2.0
A+
nsq
Realtime distributed messaging platform. Ships nsqd, nsqlookupd, and nsqadmin as static Go binaries on a hardened nonroot Wolfi base; nsqd data path is a writable volume.
v1.3.011.0 MB3 versions
MessagingstandardMIT
B 1
ntfy
Simple HTTP-based pub-sub notification service for sending push notifications to phones and desktops from any script. From source with the web UI embedded (no Node at runtime) on a hardened nonroot Wolfi base.
v2.25.020.4 MB
MessagingstandardApache-2.0
B 1
oauth2-proxy
Reverse-proxy authentication layer that secures upstream apps by delegating sign-in to OIDC and OAuth2 providers.
v7.15.39.9 MB
Secrets & identitystandardMIT
B 1
ollama
Local LLM runtime that pulls, runs, and serves open models (Llama, Gemma, Qwen, DeepSeek, and more) behind a simple REST API. CPU-only image; the chart mounts a writable volume for the model store.
v0.32.51.6 GB
Machine learning & AIstandardMIT
B 1
opa
Open Policy Agent, the CNCF general-purpose policy engine. Evaluates Rego policies over JSON and YAML to enforce authorization, admission control, and configuration rules across the stack.
v1.19.013.7 MB
Security & supply chainstandardApache-2.0
B 1
OpenBao
Open-source secrets and encryption management for tokens, keys, and certificates, with dynamic secrets and leasing. The Linux Foundation MPL-2.0 community fork of HashiCorp Vault.
v2.6.142.2 MB
SecretsstandardMPL-2.0
A+
openfga
Fine-grained authorization engine (Zanzibar-style relationship-based access control) over HTTP and gRPC. From source on a hardened nonroot Wolfi base; datastore is the operator's choice.
v1.18.120.6 MB
IdentitystandardApache-2.0
A+
openldap
OpenLDAP slapd, the reference open-source LDAP directory server, with the LMDB (back-mdb) backend and the client tools. Runs nonroot on unprivileged ports 1389/1636 and backs directory-driven auth for the identity stack.
v2.6.1311.9 MB
IdentitystandardOLDAP-2.8
D 58
OpenSearch
Search and analytics suite with a Kibana-style dashboards UI. The Apache-2.0 community fork of Elasticsearch and the recommended open alternative.
v3.7.0965.3 MB
SearchstandardApache-2.0
B 1
OpenTelemetry Collector
OpenTelemetry Collector that receives, processes, and exports traces, metrics, and logs, a vendor-neutral pipeline for telemetry routing.
v0.157.0116.1 MB
ObservabilitystandardApache-2.0
D 2
opentofu
Open-source, community-governed fork of Terraform, an infrastructure-as-code CLI. Image only, no chart.
v1.12.534.8 MB
CI/CD & registrystandardMPL-2.0