Images

200 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 200 available now.

B 1
livekit
WebRTC SFU server for scalable real-time audio, video, and data. Single static Go binary on a hardened nonroot Wolfi base; config via mounted YAML or LIVEKIT_ env.
v1.13.418.0 MB
Media & streamingstandardApache-2.0
B 2
Loki
Horizontally scalable log aggregation system from Grafana that indexes only labels, not full log text. Like Prometheus, but for logs. Licensed AGPL.
v3.7.488.1 MB
ObservabilitystandardAGPL-3.0
B 1
mailpit
Email and SMTP testing tool with a web UI for capturing and inspecting messages during development. Image only, no chart.
v1.30.69.3 MB
Apps & productivitystandardMIT
A+
MariaDB
Community-developed relational database and drop-in MySQL successor, GPL-licensed and fully open. Default MySQL-compatible engine for the catalog.
v12.3.2117.9 MB3 versions
RelationalcriticalGPL-2.0
A+
matomo
Matomo, the self-hosted web analytics platform and a privacy-respecting alternative to Google Analytics: you keep the raw data. Built from the official release tarball on a hardened Wolfi php-8.3-fpm runtime fronted by nginx built from source (nonroot, read-only rootfs, supervisord), with the vendored twig/twig replaced by 3.28.0 to clear 14 advisories the shipped 3.11.3 carries. The tarball ships no composer.lock, so the recipe re-materialises the dependency inventory from vendor/composer/installed.php purely so scanners can enumerate what is vendored. Image only, no chart.
v5.12.090.2 MB2 versions
Apps & productivitystandardGPL-3.0+
B 2
mattermost
Open-source, self-hosted team messaging and collaboration platform (a Slack alternative) with channels, direct messages, file sharing, and integrations. Packaged from Mattermost's official Team Edition server release; requires an external PostgreSQL.
v11.9.0403.6 MB
MessagingstandardAGPL-3.0
C 6
maven
JDK base image with Apache Maven, used as the build stage for Maven projects; run the resulting jar on jre. Line 3.9.
v3.9.16110.1 MB3 versions
Build toolstandardApache-2.0
D 3
mediamtx
Real-time media server and proxy for RTSP, RTMP, HLS, WebRTC, and SRT. Single static Go binary on a hardened nonroot Wolfi base; config via a mounted mediamtx.yml.
v1.19.317.7 MB
Media & streamingstandardMIT
A+
Meilisearch
Fast, typo-tolerant full-text search engine with an instant-search API, easy to embed for site and in-app search with relevant results out of the box.
v1.51.094.1 MB3 versions
SearchstandardMIT
A+
Memcached
Simple, high-performance distributed in-memory cache for storing small objects and database query results to reduce backend load.
v1.6.457.2 MB
CachestandardBSD-3-Clause
D 4
mimir
Horizontally scalable, highly available long-term storage for Prometheus metrics. Single static Go binary (all-in-one or microservices target) on a hardened nonroot Wolfi base; object storage is the operator's choice.
v3.1.239.5 MB
ObservabilitystandardAGPL-3.0
B 1
miniflux
Minimalist, opinionated RSS and Atom feed reader with a clean web UI and a REST API. Single pure-Go static binary on a hardened nonroot Wolfi base; needs PostgreSQL at runtime (operator-provided).
v2.3.28.9 MB
Apps & productivitystandardApache-2.0