Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

A+
perl
Hardened Perl interpreter for scripts, text processing, and tooling. A base image to FROM for Perl workloads. Latest stable (5).
v5.44.014.2 MB
Language runtimestandardArtistic-1.0-Perl OR GPL-1.0+
B 2
perses
CNCF dashboards and observability visualization tool with an embedded React UI and 24 default panel/datasource plugins. From source (Node UI build embedded in a static Go binary) on a hardened nonroot Wolfi base.
v0.53.192.1 MB
ObservabilitystandardApache-2.0
A+
pgbouncer
Lightweight connection pooler for PostgreSQL that fronts thousands of client connections with a small backend pool, cutting per-connection overhead.
v1.25.27.6 MB3 versions
RelationalstandardISC
A+
pgpool
PostgreSQL connection pooler, load balancer and query router. Pools client connections, spreads read-only queries across streaming-replication standbys, and detaches a backend that fails its health check.
v4.7.216.4 MB3 versions
RelationalstandardHPND
A+
php
Hardened PHP CLI with common extensions, a base image to FROM for PHP apps. Latest 3 stable lines (8.3/8.4/8.5).
v8.5.948.2 MB3 versions
Language runtimestandardPHP-3.01
A+
phpmyadmin
phpMyAdmin, the web console for MySQL and MariaDB. Built from the official release tarball on a hardened Wolfi php-8.3-fpm + nginx runtime (nonroot, read-only rootfs, supervisord), with the stale vendored composer deps (twig, symfony/cache, symfony/process, sodium_compat) re-resolved to their fixed releases and the bundled js-cookie prototype-pollution hole patched. Stateless — the chart is a Deployment that supplies config.inc.php via a ConfigMap, keeps the blowfish_secret across upgrades, and can bundle MariaDB.
v5.2.365.2 MB
Apps & productivitystandardGPL-2.0
D 3
pnpm
Node base image with pnpm preinstalled via corepack, used as the build stage for pnpm projects. Lines 10/11.
v11.19.060.6 MB
Build toolstandardMIT
B 2
pocketbase
Open-source backend in a single file with an embedded SQLite database, auth, file storage, realtime subscriptions, and an admin dashboard over a REST API. Pure-Go static binary (UI embedded) on a hardened nonroot Wolfi base; state on a writable volume.
v0.39.512.2 MB
Apps & productivitystandardMIT
D 2
poetry
Python base image with Poetry for dependency management and packaging, used as the build stage for Python projects. Line 2.
v2.4.147.2 MB
Build toolstandardMIT
B 1
postgres-exporter
Prometheus exporter that collects PostgreSQL activity, replication, and performance stats and exposes them as metrics for monitoring.
v0.20.15.6 MB
Metrics/ExportercriticalApache-2.0
A+
PostgreSQL
Advanced open-source relational database (v18.x) with strong SQL, ACID transactions, JSON, and a rich extension ecosystem. The catalog's default SQL engine.
v18.482.4 MB3 versions
RelationalcriticalPostgreSQL
C 1
PostgreSQL + DocumentDB
PostgreSQL 17 plus the open DocumentDB extension, providing BSON document storage and queries. The storage backend that powers FerretDB v2.
v0.107.0135.8 MB3 versions
DocumentstandardMIT