Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

A+
ClickHouse
Column-oriented OLAP database for real-time analytical queries over very large datasets, with high ingest rates and fast aggregations.
v26.7.1.1315229.7 MB3 versions
AnalyticalstandardApache-2.0
D 13
code-server
VS Code in the browser (Coder's code-server), a full IDE served over HTTP. Ships Coder's official prebuilt release (bundled Node 24 + compiled VS Code) hardened on a minimal, nonroot Wolfi base; runs as a single-replica Deployment with a persistent workspace and PASSWORD login.
v4.131.0234.8 MB
Developer tools / IDEstandardMIT
C 1
composer
PHP base image with the Composer dependency manager, used as the build stage for PHP projects. Line 2.
v2.10.228.8 MB3 versions
Build toolstandardMIT
D 11
Coolify
Control-plane application for Coolify, an open-source self-hostable PaaS alternative to Heroku, Vercel, and Netlify for deploying apps, databases, and services on your own servers.
v4.2.0119.0 MB
PaaSstandardApache-2.0
D 5
Coolify Realtime
Realtime server component of Coolify, providing the websocket connections and terminal/log gateway for the dashboard. Licensed AGPL.
v1.0.1699.6 MB
PaaSstandardAGPL-3.0+
B 1
coredns
Fast, flexible DNS server that chains plugins to serve DNS and service discovery, the default cluster DNS for Kubernetes.
v1.14.623.1 MB
CoordinationstandardApache-2.0
B 1
coroot
Coroot — open-source observability/APM (eBPF-based metrics, logs, traces, cost insights and service maps) with an embedded Vue UI. Built from source on Wolfi (go:embedded frontend, cgo lz4), prometheus/ch-go bumped to their fixed lines. Image only, no chart.
v1.23.326.0 MB
ObservabilitystandardApache-2.0
B 1
cosign
Sigstore's container-signing CLI. Keyless sign and verify of images, SBOMs, and attestations against the Fulcio/Rekor transparency log. Image only, no chart.
v3.1.230.2 MB
Security & supply chainstandardApache-2.0
A+
cosmian-kms
KMIP 2.1 key management server with PKCS#11 and Google/Microsoft CSE support -- the only KMIP speaker in this catalog. Shipped under BUSL-1.1, which is NOT OSI-approved AND caps production use at 2 vCPUs (1 physical core) while barring third-party offering; read the licence before deploying. Built non-FIPS against Wolfi's OpenSSL, so it is NOT FIPS 140-3 validated despite upstream's description.
v5.25.015.4 MB3 versions
SecretslowBUSL-1.1
A+
CouchDB
Document database with an HTTP/JSON API and multi-master replication, designed for offline-first sync across nodes and devices.
v3.5.2126.9 MB3 versions
DocumentstandardApache-2.0
B 2
crossplane
Crossplane, the CNCF control-plane framework that turns Kubernetes into a universal API for infrastructure. Installs Providers, Functions and Configurations as OCI packages, and lets platform teams publish their own composite APIs from CompositeResourceDefinitions and Compositions.
v2.3.421.7 MB3 versions
GitOpsstandardApache-2.0
A+
deno
Hardened Deno runtime for JavaScript and TypeScript, secure by default with explicit permissions and built-in tooling. Latest stable (2).
v2.9.447.9 MB
Language runtimestandardMIT