Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

A+
Redis
In-memory key-value store used as a cache, message broker, and ephemeral datastore. Shipped under AGPL (not permissive); Valkey is the BSD-licensed open alternative.
v8.10.015.2 MB3 versions
CachecriticalAGPL-3.0
B 1
redis-exporter
Prometheus exporter that scrapes Redis and Valkey runtime stats and exposes them as metrics for dashboards and alerts.
v1.88.04.6 MB3 versions
Metrics/ExportercriticalMIT
D 3
renovate
Automated dependency-update CLI that opens PRs to keep dependencies current, on a hardened Wolfi Node runtime. Image only, no chart.
v44.6.0118.3 MB
CI/CD & registrystandardAGPL-3.0
B 1
rqlite
Lightweight, distributed relational database built on SQLite and Raft. Ships rqlited and the rqlite CLI as static (musl) Go binaries on a hardened nonroot Wolfi base; data dir is a writable volume.
v10.2.518.9 MB
RelationalstandardMIT
B 1
ruby
Hardened Ruby interpreter with Bundler, a base image to FROM for Ruby apps. Latest 3 stable lines (3.2/3.3/3.4).
v3.4.1046.8 MB
Language runtimestandardRuby
C 1
rust
Hardened Rust toolchain (cargo plus rustc) for build stages; ship the compiled binary on the static base. Latest 3 stable lines (1.94/1.95/1.96).
v1.97.1363.4 MB
Language runtimestandardMIT OR Apache-2.0
A+
RustFS
S3-compatible, high-performance object store written in Rust with a zero-master architecture, positioned as an Apache-2.0 MinIO alternative. Beta/preview.
v1.0.0_beta1282.5 MB3 versions
Object storagelowApache-2.0
A+
ScyllaDB
High-throughput, low-latency wide-column store, API-compatible with Apache Cassandra and DynamoDB. This 6.x build is the final OSS line under AGPL.
v2026.2.278.2 MB
Wide-columnlowAGPL-3.0
B 1
sealed-secrets
Sealed Secrets, the controller that lets you commit encrypted secrets to Git safely. A cluster-side private key decrypts SealedSecret resources into ordinary Kubernetes Secrets, so the encrypted form is the only thing that ever leaves the cluster.
v0.38.414.5 MB3 versions
Security & supply chainstandardApache-2.0
B 1
SeaweedFS
Fast distributed storage for blobs, objects, and files (S3 API) built on Facebook's Haystack design, with O(1) disk seeks for billions of small files. Default object store after MinIO restricted its community edition.
v4.4048.8 MB
Object storagestandardApache-2.0
D 4
Solr
Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections.
v10.0.0333.1 MB
SearchlowApache-2.0
C 6
sonar-scanner-cli
SonarScanner CLI, the standalone scanner that analyzes a project and pushes results to a SonarQube server. Bundles its own OpenJDK. Image only, no chart.
v8.1.0.638985.2 MB
CI/CD & registrystandardLGPL-3.0