Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

B 1
descheduler
Kubernetes descheduler that evicts pods so the scheduler can re-place them for better cluster balance. Single static Go binary on a hardened nonroot Wolfi base.
v0.36.021.8 MB
CoordinationstandardApache-2.0
B 1
dex
Federated OpenID Connect (OIDC) identity provider. Acts as a portal to other identity providers (LDAP, SAML, GitHub, Google, OIDC) and issues OIDC tokens to apps and Kubernetes.
v2.45.117.0 MB
IdentitystandardApache-2.0
B 1
distribution
The CNCF reference OCI and Docker registry server for storing and distributing container images and other OCI artifacts.
v3.1.116.2 MB
RegistrystandardApache-2.0
C 1
DocumentDB
Self-contained MongoDB-compatible server bundling PostgreSQL, the DocumentDB extension, and a wire gateway. Linux Foundation project, truly open under MIT.
v0.114.0141.7 MB3 versions
DocumentstandardMIT
A+
dotnet
Hardened .NET SDK for building and running .NET apps. Use as a build base; ships the current LTS line (10). Image only, no chart.
v10.0.110271.1 MB
Language runtimestandardMIT
A+
dotnet-runtime
Hardened .NET runtime for console and worker apps, no SDK. Build on the dotnet image, then run here. Lines 8/9/10.
v10.0.11061.1 MB3 versions
Runtime basestandardMIT
A+
Dragonfly
Multi-threaded, Redis- and Memcached-compatible in-memory datastore built to scale vertically on one node. BUSL is source-available, not open source; prefer Valkey (BSD-3-Clause).
v1.39.025.1 MB3 versions
CachelowBUSL-1.1
D 3
drupal
Drupal core, the open-source CMS and content framework. Built from the official release tarball on a hardened Wolfi php-8.4-fpm + nginx runtime (nonroot, read-only rootfs, supervisord); the chart supplies settings.php via ConfigMap and a MySQL backend. Ships the 11.3/11.4 lines (11.2 is held because drupal/core-recommended pins guzzle below its CVE fix).
v11.4.468.5 MB
Apps & productivitystandardGPL-2.0+
A+
duckdb
In-process analytical SQL database CLI, shipped from upstream's official precompiled binary. Image only, no chart.
v1.5.526.2 MB3 versions
Databases & enginesstandardMIT
C 4
Elasticsearch
Distributed search and analytics engine. Shipped under SSPL/Elastic License, which are not OSI-approved; OpenSearch (Apache-2.0) is the open drop-in fork.
v9.4.4639.6 MB
SearchlowSSPL-1.0
A+
elixir
Hardened Elixir runtime on the BEAM VM, built on Erlang/OTP, for concurrent, fault-tolerant apps (e.g. Phoenix). Latest stable (1.18).
v1.19.568.9 MB3 versions
Language runtimestandardApache-2.0
A+
emqx
Massively scalable, distributed MQTT broker for IoT, IIoT, and connected vehicles. Speaks MQTT 5.0 over TCP/TLS/websockets with a clustering engine and a web dashboard. Packaged from EMQX's official Erlang/OTP release. Licensed BSL 1.1 (single node free; clustering requires a commercial license).
v6.2.2125.8 MB
MessagingstandardBUSL-1.1