Images

375 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 375 available now.

A 1
argo-rollouts
The Argo Rollouts controller, progressive delivery for Kubernetes (canary and blue-green Rollouts, analysis runs, traffic shaping through ingresses…
v1.10.026.9 MB2 versions
CIstandardApache-2.0
A 3
argo-workflows
Kubernetes-native workflow engine for orchestrating parallel jobs as DAGs. Ships the workflow-controller, the argo CLI/API server with an embedded…
v4.1.4103.3 MB3 versions
WorkflowstandardApache-2.0
A 3
argocd
Argo CD, the CNCF declarative GitOps continuous-delivery controller for Kubernetes. One multi-call binary serves every component (server,…
v3.5.4113.3 MB3 versions
GitOpsstandardApache-2.0
A+
aspnet
Hardened ASP.NET Core runtime for web apps and APIs, no SDK. Build on the dotnet image, then run here. Lines 8/9/10.
v10.0.11272.6 MB2 versions
Runtime basestandardMIT
A 2
Atlantis
Terraform pull-request automation that runs plan on PRs and apply from PR comments, enforcing reviewed, Git-driven infrastructure changes with state…
v0.48.077.2 MB
GitOpsstandardApache-2.0
A 1
authelia
Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion…
v4.39.2823.1 MB
IdentitystandardApache-2.0
A+
authentik
Self-hosted identity provider (OIDC, SAML, LDAP, SCIM) with flows, policies, and application/provider management. Built clean-room from source on…
v2026.8.3266.9 MB
Secrets & identitystandardMIT
A+
backing-image-manager
Longhorn's backing image server, built from the longhorn/backing-image-manager source with qemu-img, losetup and the filesystem tools it calls.…
v1.13.046.4 MB3 versions
Storage & platformstandardApache-2.0
A 1
bifrost
AI gateway giving one OpenAI-compatible API over many model providers, with load balancing and failover. Single Go binary with the web console…
v2.2.654.2 MB3 versions
AI gatewaystandardApache-2.0
A+
bind
ISC BIND 9, the authoritative and recursive DNS server (9.20 stable line). Wolfi's source-built named, nonroot on port 5353, with a default…
v9.20.2919.1 MB
CoordinationstandardMPL-2.0
A 1
blackbox-exporter
Prometheus exporter that probes endpoints externally over HTTP, HTTPS, TCP, DNS, and ICMP for black-box uptime and latency monitoring.
v0.28.08.9 MB
Metrics/ExporterstandardApache-2.0
A 3
buildah
Buildah, the daemonless OCI image builder, built from source and run rootless as uid 1001 with crun and fuse-overlayfs, the same setup as the Podman…
v1.45.163.2 MB2 versions
Security & supply chainstandardApache-2.0