Images

381 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 381 available now.

A+
erlang
Hardened Erlang/OTP runtime on the BEAM VM, built for highly concurrent, fault-tolerant systems. Latest stable lines (27/28/29).
v29.1.166.1 MB3 versions
Language runtimestandardApache-2.0
A 2
etcd
Distributed, strongly consistent key-value store using Raft consensus. The backing store for Kubernetes and a building block for service coordination…
v3.7.222.1 MB
CoordinationcriticalApache-2.0
A+
excalidraw
Open-source virtual whiteboard for sketching hand-drawn-style diagrams. Self-hostable as a static SPA served by hardened nginx, with no backend or…
v0.18.128.6 MB
Apps & productivitystandardMIT
A 1
external-dns
Synchronizes Kubernetes Services and Ingresses with DNS providers so records are managed automatically.
v0.23.038.1 MB
Coordination & meshstandardApache-2.0
A 1
external-secrets
External Secrets Operator, the CNCF operator that syncs secrets from external APIs (AWS/GCP/Azure Secrets Manager, Vault, and many more) into…
v2.12.052.7 MB2 versions
Security & supply chainstandardApache-2.0
A 1
FerretDB
MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension. The clean-license…
v2.7.010.4 MB
DocumentstandardApache-2.0
B 2
filebrowser
Web-based file manager with a built-in UI, users, and share links. From source (Vite UI embedded in a static Go binary) on a hardened nonroot Wolfi…
v2.63.2315.6 MB2 versions
Apps & productivitystandardApache-2.0
A+
flink
Apache Flink, the stateful stream and batch processing engine. Upstream's official binary distribution on a hardened nonroot Wolfi JRE 21, with the…
v2.3.0360.5 MB
WorkflowstandardApache-2.0
A+
floci
Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE. The hardened image…
v2.2.0168.4 MB3 versions
Apps & productivitystandardMIT
A+
floci-full
Opt-in, NON-hardened companion to the floci image: it runs as root and expects the host Docker socket mounted, which lets it emulate all 65 of…
v2.2.0168.4 MB
Apps & productivitystandardMIT
A+
Fluent Bit
Lightweight, fast log and metrics processor and forwarder for collecting, filtering, and shipping telemetry to many backends.
v5.1.339.6 MB
ObservabilitystandardApache-2.0
A+
fluentd
Fluentd, the CNCF unified logging layer that collects, parses, buffers and routes logs (forward, HTTP and tail inputs; stdout and file outputs built…
v1.19.434.6 MB
ObservabilitystandardApache-2.0