Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

A+
Garage
Lightweight, S3-compatible object store for small, self-hosted, geo-distributed deployments that stays available across node failures. Licensed AGPL; runs well on modest hardware.
v2.3.029.7 MB3 versions
Object storagestandardAGPL-3.0
D 25
ghost
Open-source Node.js publishing platform for blogs, newsletters, and membership sites. Packaged from Ghost's official npm distribution on a hardened Wolfi Node 22; configured entirely via environment and backed by an external MySQL/MariaDB with a content PVC for themes, images, and data.
v6.55.0182.8 MB
Apps & productivitystandardMIT
D 4
Gitea
Lightweight self-hosted Git service with repositories, issues, pull requests, and built-in CI/CD (Actions). A low-footprint GitHub alternative.
v1.27.170.1 MB
GitstandardMIT
A+
go
Hardened Go toolchain for compiling binaries in a build stage; pair the output with the static base for the runtime. Latest 3 stable lines (1.24/1.25/1.26).
v1.26.559.1 MB
Language runtimestandardBSD-3-Clause
B 1
gotify
Self-hosted server for sending and receiving real-time push messages over WebSocket, with a web UI and app tokens. From source (UI embedded, CGO+static-musl SQLite) on a hardened nonroot Wolfi base; data on a writable volume.
v2.9.113.2 MB
MessagingstandardMIT
C 7
gradle
JDK base image with Gradle, used as the build stage for Gradle projects; run the resulting jar on jre. Line 9.
v9.6.1239.1 MB
Build toolstandardApache-2.0
C 5
graylog
Graylog, the log-management and analysis server (search, dashboards, alerting, GELF/Beats inputs). Built clean-room on a hardened Wolfi JRE (nonroot, read-only rootfs); the chart provides MongoDB (metadata) and OpenSearch (log storage) backends. Graylog Server is SSPL-1.0 (source-available, not OSI-approved).
v7.1.6425.0 MB
ObservabilitystandardSSPL-1.0
D 3
grype
Anchore's vulnerability scanner for container images and filesystems, driven by the same SBOM engine as Syft. Image only, no chart.
v0.116.129.8 MB
Security & supply chainstandardApache-2.0
A+
HAProxy
High-performance TCP and HTTP load balancer and reverse proxy known for reliability and fine-grained traffic control at scale.
v3.4.023.0 MB3 versions
GatewaystandardGPL-2.0+
D 5
Harbor core
Core API server and control plane of the Harbor container registry, handling auth, projects, policies, and orchestration.
v2.15.227.8 MB
RegistrystandardApache-2.0
D 3
Harbor exporter
Prometheus exporter that exposes Harbor registry health and usage metrics for monitoring.
v2.15.214.7 MB
RegistrystandardApache-2.0
D 3
Harbor jobservice
Harbor's asynchronous job runner that executes replication, garbage collection, and image-scan tasks in the background.
v2.15.219.0 MB
RegistrystandardApache-2.0