Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

D 5
trivy
Aqua Security's all-in-one vulnerability, misconfiguration, secret, and SBOM scanner for images, filesystems, and repositories. Image only, no chart.
v0.72.050.5 MB
Security & supply chainstandardApache-2.0
B 1
tyk
Full-featured API gateway with rate limiting, auth, and quotas. Single static Go binary on a hardened nonroot Wolfi base; Redis is a runtime dependency the operator provides.
v5.13.191.1 MB
GatewaystandardMPL-2.0
A+
typesense
Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database), tuned for low-latency site and in-app search.
v30.2147.4 MB3 versions
SearchstandardGPL-3.0
A+
uv
Python base image with uv, a fast Rust-based installer and resolver, used as the build stage for Python projects. Line 0.11.
v0.12.145.8 MB3 versions
Build toolstandardMIT OR Apache-2.0
A+
Valkey
BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. QuenchWorks' default cache and the recommended Redis drop-in replacement.
v9.1.114.9 MB3 versions
CachecriticalBSD-3-Clause
A+
varnish
HTTP reverse-proxy cache (web accelerator) that fronts an origin and serves its responses from memory, cutting backend load and tail latency. Caching policy is VCL, which varnishd compiles to native code at startup. The chart supplies the VCL and the backend.
v9.0.3196.0 MB3 versions
CachestandardBSD-2-Clause
B 1
vault
Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets, leasing, and PKI. Shipped under the Business Source License 1.1, which is not OSI-approved; OpenBao (MPL-2.0) is the open drop-in fork. Built from source with the web UI included; the chart supports multi-node raft HA. The 1.20.x line is CVE-blocked upstream and not shipped.
v2.0.395.5 MB
SecretslowBUSL-1.1
A+
Vector
High-performance observability pipeline that collects, transforms, and routes logs, metrics, and traces between sources and sinks.
v0.57.032.5 MB
ObservabilitystandardMPL-2.0
B 1
velero
CNCF backup and disaster-recovery tool for Kubernetes cluster resources and persistent volumes. Single static Go binary on a hardened nonroot Wolfi base; object-store and snapshot backends are the operator's choice.
v1.18.230.3 MB
Storage & platformstandardApache-2.0
A+
victorialogs
Fast, cost-efficient logs database with the LogsQL query language. Single static Go binary on a hardened nonroot Wolfi base; log data lives on a writable volume.
v1.51.09.8 MB
ObservabilitystandardApache-2.0
A+
VictoriaMetrics
Fast, cost-efficient time-series database that speaks PromQL and Prometheus remote_write. Drop-in long-term storage or full replacement for Prometheus.
v1.148.010.9 MB
Time serieslowApache-2.0
B 2
vikunja
Self-hosted to-do and project management app (lists, kanban, gantt, calendar) serving both the API and the Vue web UI. From source with the UI embedded on a hardened nonroot Wolfi base; SQLite or an external SQL database.
v2.3.029.7 MB
Apps & productivitystandardAGPL-3.0+