Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

C 4
jmeter
Apache JMeter load-testing and performance-measurement tool, the official binary distribution running on a hardened Wolfi JRE. Image only, no chart.
v5.6.3140.2 MB
ObservabilitystandardApache-2.0
A+
jre
Hardened Java runtime (JRE) for running a built jar, no compiler. Pair with the jdk, maven, or gradle build image. LTS lines 17/21/25.
v25.0.483.2 MB3 versions
Runtime basestandardGPL-2.0-with-classpath-exception
B 1
k6
Developer-friendly load and performance testing tool scripted in JavaScript. Single static Go binary on a hardened nonroot Wolfi base; test scripts are mounted at runtime.
v2.1.016.6 MB
ObservabilitystandardAGPL-3.0
C 3
Kafka
Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing.
v4.3.1204.3 MB
MessagingcriticalApache-2.0
B 2
keda
Kubernetes event-driven autoscaler that scales workloads based on external event sources (queues, streams, metrics). Ships the operator and metrics adapter as static Go binaries on a hardened nonroot Wolfi base.
v2.20.179.8 MB
CoordinationstandardApache-2.0
D 5
Keycloak
Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs.
v26.7.0231.6 MB
IdentitystandardApache-2.0
A+
kong
API gateway and ingress controller on a patched OpenResty, with routing, auth, rate limiting, and a plugin ecosystem. Built from source against current OpenSSL rather than Kong's pinned older crypto; ships the Admin API without the Kong Manager GUI, whose assets are not built from source upstream.
v3.9.342.3 MB
GatewaystandardApache-2.0
B 1
kube-state-metrics
Exposes the state of Kubernetes objects as Prometheus metrics for dashboards and alerts. Image only, no chart.
v2.19.118.2 MB3 versions
ObservabilitystandardApache-2.0
D 5
kubectl
Hardened kubectl image with the common cluster toolbelt (helm, kustomize, jq, a busybox shell) — the 0-CVE answer to alpine/k8s and bitnami/kubectl for CI jobs and in-cluster tooling. Image only, no chart.
v1.36.361.3 MB2 versions
CI/CD & registrystandardApache-2.0
B 2
kuma
CNCF service mesh control plane (Envoy-based) for multi-zone and multi-cluster meshes. Ships kuma-cp and kumactl with an embedded GUI, built from source on a hardened nonroot Wolfi base; default in-memory store runs standalone.
v2.14.062.5 MB
Coordination & meshstandardApache-2.0
D 20
kyverno
Kubernetes-native policy engine for validating, mutating, and generating resources with no new language. Ships the controllers and CLI as static Go binaries on a hardened nonroot Wolfi base.
v1.18.1253.3 MB
Security & supply chainstandardApache-2.0
B 1
litestream
Streaming replication for SQLite databases to object storage such as S3, GCS, and Azure. Image only, no chart.
v0.5.1516.9 MB
Storage & platformstandardApache-2.0