{ "apiVersion": "v1", "resource": "roadmap", "total": 63, "data": [ { "name": "Milvus", "category": "Search & vector", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Scalable vector database for AI workloads. Measured 2026-09-30: releases ship only compose files and Wolfi has no package, so it is a from-source build: the C++ core through conan (about a hundred packages, often fetched as prebuilt binaries the scanner cannot see) plus a Rust component, a multi-hour build. Held until Wolfi packages it or a scanned from-source conan build is scoped." }, { "name": "Redpanda", "category": "Messaging & streaming", "license": "BSL-1.1", "licenseClean": "caution", "priority": "planned", "note": "Kafka-compatible streaming. Source-available, not OSI.", "cleanAlternative": "Kafka or Pulsar (Apache-2.0), both already shipped." }, { "name": "Istio", "category": "Coordination & mesh", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Service mesh built on Envoy. Ambient mode SHIPPED 2026-10-08: istiod, istio-cni and ztunnel charts on 1.30.5, gated on mTLS (HBONE) traffic between two pods. Still held: L7 waypoints and sidecar mode, which need the Istio proxyv2 image, which has no melange-buildable path." }, { "name": "Consul", "category": "Coordination & mesh", "license": "BUSL-1.1", "licenseClean": "caution", "priority": "planned", "note": "HashiCorp Consul. BUSL-1.1: source-available, NOT OSI. Recommendation is to skip -- the mesh slot is already covered by Kuma (shipped) plus Linkerd and Istio in this wave, all OSI-licensed. Revisit on explicit demand.", "cleanAlternative": "Kuma (Apache-2.0) -- already shipped; or Linkerd / Istio." }, { "name": "Nomad", "category": "Coordination & mesh", "license": "BUSL-1.1", "licenseClean": "caution", "priority": "planned", "note": "Workload scheduler. Source-available, not OSI." }, { "name": "SurrealDB", "category": "Databases & engines", "license": "BUSL-1.1", "licenseClean": "caution", "priority": "planned", "note": "Multi-model database. Source-available, not OSI." }, { "name": "Apache Ozone", "category": "Storage & platform", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Scalable distributed object store (S3 + HDFS). Measured 2026-09-28: the 2.2.1 distribution carries 143 fixable findings in 22 jars. Most swap on their own line (netty 4.1.137, jackson 2.21.5, log4j 2.26.1), but jetty-server 9.4 is fixed only in 12.1, spring-core 5.3.39 only in 7.0 and aircompressor 0.27 only in 2.x. Needs an upstream move off those lines." }, { "name": "SonarQube", "category": "Storage & platform", "license": "LGPL-3.0", "licenseClean": "clean", "priority": "planned", "note": "Continuous code-quality and security inspection. Measured 2026-09-28: the 26.9 Community distribution carries 72 findings (4 critical), most inside its bundled Elasticsearch 9.4.3 (x-pack modules, transport-netty4) and in fat jars (sonar-application, the scanner engine). Needs the embedded Elasticsearch rebuilt or swapped before it can gate clean." }, { "name": "Dokploy", "category": "Storage & platform", "license": "Apache-2.0 + DSAL-1.0", "licenseClean": "caution", "priority": "planned", "note": "Self-hostable PaaS on Docker Swarm. Open-core: most is Apache-2.0, the /proprietary parts are source-available (DSAL-1.0). Not a fit for the hardened catalog: it requires root, the Docker socket, and an initialized Swarm, so it cannot run nonroot or read-only.", "cleanAlternative": "Coolify (Apache-2.0), already shipped." }, { "name": "Discourse", "category": "Apps & productivity", "license": "GPL-2.0-or-later", "licenseClean": "agpl", "priority": "planned", "note": "Ruby discussion and forum platform backed by PostgreSQL and Redis. Measured 2026-09-29 at 2026.9.0: the Gemfile.lock and pnpm-lock.yaml scan clean and Wolfi has ruby-3.4, ImageMagick 7, pngquant and oxipng, but two native gems ship only prebuilt binaries the scanner cannot see into: libv8-node (V8 for mini_racer, which PrettyText needs; a source build is a multi-hour Node V8 compile per arch) and sass-embedded (a bundled dart-sass, needed at runtime for theme CSS; Wolfi has the Dart SDK, so that half is buildable). Held on the V8 build." }, { "name": "Moodle", "category": "Apps & productivity", "license": "GPL-3.0-or-later", "licenseClean": "agpl", "priority": "planned", "note": "PHP learning management system backed by MySQL, MariaDB, or PostgreSQL. Measured 2026-09-29 at 5.2.3: the PHP side is fixable (5.2 runs composer install at build, so guzzle, psr7, aws-sdk-php, php-jwt, slim and jmespath float like mediawiki), but the H5P editor ships a prebuilt CKEditor 5 43.0.0 bundle (CVE-2024-45613, CVE-2026-28343 fixed only in 47.6.0; lodash-es CVE-2026-4800 HIGH). The fix is a four-major rebuild of a custom H5P build nothing would test, so the image is held until Moodle updates that bundle." }, { "name": "SuiteCRM", "category": "Apps & productivity", "license": "AGPL-3.0-only", "licenseClean": "agpl", "priority": "planned", "note": "PHP customer relationship management application backed by MySQL or MariaDB. Measured 2026-10-04 on 8.10.2: the shipped frontend is Angular 18 (203 yarn.lock findings, fixed only in Angular 19 and later) and api-platform/core v3.4.17 is fixed only in v4, so both need major ports upstream; guzzle and flysystem would float. Held until SuiteCRM moves to Angular 19+ and api-platform 4." }, { "name": "Appsmith", "category": "Apps & productivity", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Low-code internal-tools and admin-panel builder backed by PostgreSQL and Redis. Measured 2026-09-30 (v2.4.2, no release binaries, no Wolfi package): the upstream image is all-in-one under supervisor (Java server, React editor, Node RTS and MCP, Caddy, Redis, PostgreSQL and MongoDB). Appsmith has since removed PostgreSQL support (scripts/prepare_server_artifacts.sh builds only the MongoDB server), so the server needs MongoDB, which is SSPL. A clean image would run against an external MongoDB, or FerretDB/DocumentDB if Appsmith's use of transactions works there, which is unverified. Maven and yarn builds exceed the local gate, so it is gated in CI." }, { "name": "Gotenberg", "category": "Apps & productivity", "license": "MIT", "licenseClean": "clean", "priority": "planned", "note": "Stateless HTML and URL to PDF conversion API. Recipe committed 2026-09-26 (Chromium variant; Wolfi has no LibreOffice): everything gates clean except chromium CVE-2026-13032, fixed in 149.0.7827.200, which Wolfi has not published yet. Ships when it does." }, { "name": "Apache Superset", "category": "Apps & productivity", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Data exploration and business-intelligence dashboard platform backed by a metadata database and Redis. Measured 2026-09-26: 6.1.0 (and 6.0.0) have no advisories, 5.0 does. It pins pyarrow<19, whose wheel statically embeds OpenSSL 3.3.0 and libcurl 8.7.0 (Wolfi packages pyarrow 23 and newer only), and a loose PyPI resolve pulls a flask-caching that breaks its metastore cache. Needs a build from the tag's pinned requirements, a module float, and a pyarrow swap tested against result_set.py.", "blocked": true, "blockedReason": "Superset pins `cryptography <47`, `msgpack <1.1`, and `pyarrow <19`, all below the versions that fix current HIGH CVEs, so it cannot reach 0 fixable CVEs without diverging from upstream's own dependency constraints. Built and tested; held until upstream relaxes the pins or backports the fixes." }, { "name": "Jellyfin", "category": "Media & streaming", "license": "GPL-2.0-only", "licenseClean": "agpl", "priority": "planned", "note": "Self-hosted media server for movies, music, and live TV. Built 2026-09-29 from Wolfi's jellyfin 12.1 apks and it gates clean (0 fixable CVEs, boot test passes), but it is held: libSkiaSharp.so, a prebuilt NuGet binary from a Debian 10 clang 13 build, statically links libjpeg-turbo 2.1.5.1 (behind several upstream security fixes), libpng and other image libraries the scanner cannot see. Needs Skia built against the system libraries. The recipe is committed as blocked." }, { "name": "Apache Druid", "category": "Workflow & data", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Real-time analytics database for high-concurrency OLAP queries. Held 2026-09-26: the 37.0.0 distribution carries 137 findings. Two sit in the core lib/ and cannot be swapped: netty 3.10.6 (8 findings, end of life, fixes only exist in netty 4; Druid's HTTP client is built on it) and calcite-core 1.37.0 (the SQL planner, fixed in 1.42). Shipping needs Druid itself to move off both." }, { "name": "Apache Pinot", "category": "Workflow & data", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Real-time distributed OLAP datastore for low-latency analytics. Measured 2026-09-28: the 1.5.1 distribution carries 444 fixable findings (11 critical) in 31 packages, much of it netty 4.1.134 and jackson-databind 2.21.1 repeated across plugin jars. Measure again after the next release." }, { "name": "Open WebUI", "category": "Machine learning", "license": "Open WebUI License", "licenseClean": "caution", "priority": "planned", "note": "Self-hosted web UI for chatting with local and remote LLMs. Checked 2026-09-27: the license is BSD-3-Clause plus a branding clause (the Open WebUI branding may not be altered for deployments above 50 users without permission), so it is not OSI. 0.11.4 also pins sentence-transformers, transformers, onnxruntime and opencv." }, { "name": "Langflow", "category": "Machine learning", "license": "MIT", "licenseClean": "clean", "priority": "planned", "note": "Visual builder for LLM applications and agent workflows. Measured 2026-09-28: 1.12.3 resolves to 457 packages (2.3 GB). The scanner reports only chromadb 1.5.9 (no fix), but the wheels carry what it cannot see: OpenSSL 3.5.1 (ibm_db.libs), OpenSSL 3.6.2 and libcurl 8.20.0 inside pyarrow, BoringSSL in grpcio and hf_xet, and 7 bundled .libs directories (numpy, scipy, pillow, cassandra-driver). Wolfi has py3.13 pyarrow, grpcio, numpy, tokenizers and orjson, but no onnxruntime, chromadb or ibm_db, so an honest 0-CVE build needs those built from source or dropped." }, { "name": "Langfuse", "category": "Machine learning", "license": "MIT", "licenseClean": "clean", "priority": "planned", "note": "LLM observability and tracing platform backed by PostgreSQL, ClickHouse, Redis and S3. Held 2026-09-27: the core is MIT, but ee/, web/src/ee and worker/src/ee are under the Langfuse Enterprise License, which forbids distributing them, and 80 core files import from those 120 files. An image needs a build with the ee paths removed and stubbed." }, { "name": "Kibana", "category": "Observability", "license": "Elastic-2.0", "licenseClean": "caution", "priority": "planned", "note": "Visualization and dashboards for Elasticsearch. Default distribution is Elastic-2.0, not OSI.", "cleanAlternative": "OpenSearch Dashboards (Apache-2.0) over OpenSearch, both open." }, { "name": "OpenSearch Dashboards", "category": "Observability", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Visualization UI for OpenSearch. Measured 2026-09-26 at 3.8.0: the full bundle has 12 vulnerable npm packages, among them maplibre-gl 5.2.0 (CRITICAL, fixed only in 6.x) compiled into the maps, observability and anomaly-detection plugin bundles. The min distribution drops those plugins, leaving 7 patch-level fixes, but dompurify 3.4.11 is compiled into the Discover and chat UI bundles, so swapping node_modules would clear the scan and still ship the vulnerable code. Needs a from-source UI build (yarn build of OSD) to ship honestly. Re-measured 2026-10-07: an image that swaps node_modules scans 0 but still carries dompurify 3.4.11/3.4.12 in 8 browser bundles and maplibre-gl 5.2.0 in 3, so it is held. Upstream main has dompurify ^3.4.13 and maplibre-gl 6.4.1; Dashboards 3.9.0 (unreleased) is the next build to measure.", "blocked": true, "blockedReason": "OpenSearch Dashboards bundles Node dependencies pinned below their CVE fixes, so the image cannot reach 0 fixable CVEs without diverging from the upstream bundle. Built and tested; held until upstream updates them." }, { "name": "Logstash", "category": "Observability", "license": "Elastic-2.0", "licenseClean": "caution", "priority": "planned", "note": "Server-side log and event processing pipeline. Default distribution is Elastic-2.0, not OSI.", "cleanAlternative": "Vector (MPL-2.0) or Fluentd (Apache-2.0), both open pipelines." }, { "name": "EJBCA", "category": "Secrets & identity", "license": "LGPL-2.1-or-later", "licenseClean": "clean", "priority": "planned", "note": "Enterprise PKI certificate authority (Community Edition) backed by a relational database. Measured 2026-10-04 on r9.6.3 (source only, no release assets): 167 vendored jars in lib/ that Trivy identifies none of, so its scan is blind there; by filename bcprov 1.84 (CVE-2026-8763, fixed 1.85) and freemarker 2.3.34 (CVE-2026-84939, fixed 2.3.35) need swaps. Buildable with Gradle on our WildFly image; a multi-session job, not a hold." }, { "name": "Teleport", "category": "Secrets & identity", "license": "AGPL-3.0-only", "licenseClean": "agpl", "priority": "planned", "note": "Access plane providing identity-based SSH, Kubernetes, and database access. Community edition is AGPL-3.0." }, { "name": "KeyDB", "category": "Databases & engines", "license": "BSD-3-Clause", "licenseClean": "clean", "priority": "exploring", "note": "Multi-threaded Redis fork; BSD-licensed and Redis-protocol compatible. Held 2026-09-25: upstream is dormant (last release 6.3.4 in October 2023, last push May 2024) on a Redis 6.2 base, so it misses the Lua and protocol fixes Redis and Valkey shipped since. Valkey covers the slot." }, { "name": "ArangoDB", "category": "Databases & engines", "license": "BSL-1.1", "licenseClean": "caution", "priority": "planned", "note": "Multi-model database for documents, graphs, and key-value. Checked 2026-09-27: the repository LICENSE is the Business Source License 1.1, not Apache-2.0." }, { "name": "JanusGraph", "category": "Databases & engines", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Distributed graph database over pluggable storage backends. Measured 2026-09-26: the newest release (1.1.0, 2024-11) carries 57 vulnerable packages (4 CRITICAL, 35 HIGH) in its dist. The project is active but has not released since; shipping at 0 CVEs needs a from-source Maven build with dependency management across the tree." }, { "name": "Wazuh", "category": "Security & supply chain", "license": "GPL-2.0-only", "licenseClean": "agpl", "priority": "planned", "note": "SIEM and XDR platform with manager, indexer, and dashboard components." }, { "name": "Camunda", "category": "Workflow & data", "license": "Camunda-License-1.0", "licenseClean": "caution", "priority": "planned", "note": "Process automation and BPMN orchestration including the Zeebe engine. Checked 2026-09-27: the repository is under the Camunda License 1.0, not Apache-2.0." }, { "name": "search-stack", "category": "Stacks", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Umbrella: OpenSearch + OpenSearch Dashboards — search with a UI. Held 2026-10-07: chart built and gated (OpenSearch document found through Dashboards), but it bundles the opensearch-dashboards image, which is held (see that entry)." }, { "name": "Percona PMM", "category": "Observability", "license": "AGPL-3.0", "licenseClean": "clean", "priority": "planned", "note": "Percona Monitoring and Management — deep MySQL/PostgreSQL/MongoDB observability (query analytics) built on Prometheus, Grafana and VictoriaMetrics. AGPL, OSI-approved. Sized 2026-10-08 at v3.9.1 (no release binaries): pmm-server is one container that an Ansible playbook assembles on Oracle Linux 9 from eight RPMs built in the repo (pmm-managed, qan-api2, vmproxy, pmm-dump, pmm-ui, percona-dashboards) plus Percona forks of Grafana (12.4.5, frontend changes, so a full Node build unlike our grafana image) and VictoriaMetrics (pmm-6401-v1.149.0), with ClickHouse, PostgreSQL 14, nginx and supervisord in the same image. Several images of work plus a multi-process supervisor design; it waits for local gates (the btrfs metadata hold)." }, { "name": "Tiny RDM", "category": "Databases & engines", "license": "GPL-3.0", "licenseClean": "agpl", "priority": "exploring", "note": "Modern Redis/Valkey desktop GUI (Wails/Go+Vue). A desktop client, not a deployable server, so it falls outside the hardened in-cluster image model — a web Redis UI (e.g. redis-commander) would be the cache-stack UI instead." }, { "name": "GitLab CE", "category": "CI/CD & registry", "license": "MIT", "licenseClean": "caution", "priority": "exploring", "note": "Full DevOps platform (Git forge + CI/CD + registry). Heavy fit: a large Ruby monolith that bundles PostgreSQL, Redis, Gitaly, Sidekiq and Workhorse, and the gitlab-org/gitlab repo is mostly EE-proprietary — only the CE-flagged code is MIT. Far from the minimal one-purpose hardened model.", "cleanAlternative": "Gitea or Forgejo — lightweight, fully-open Git forges that drop straight into the gitops-stack." }, { "name": "OneDev", "category": "CI/CD & registry", "license": "MIT", "licenseClean": "clean", "priority": "exploring", "note": "Self-hosted Git server with built-in CI/CD, issues and kanban (Java). Heavier than Gitea/Gogs but far lighter than GitLab; an all-in-one gitops-stack backend option. Measured 2026-10-07 at 16.8.5 (47 findings): jackson-databind/core 2.22.2 in lib/ swap cleanly, but Hazelcast 5.7.0 (its newest release) relocates jackson 2.21.2 and tools.jackson 3.1.2 under com/hazelcast/shaded/, which needs a bytecode relocation rewrite or a Hazelcast release; logback 1.4.14 needs the 1.5 line; boot/ ships prebuilt Tanuki wrapper binaries." }, { "name": "Percona XtraDB Cluster Operator", "category": "Databases & engines", "license": "Apache-2.0", "licenseClean": "clean", "priority": "next", "note": "Operator for Percona XtraDB Cluster (MySQL): synchronous multi-primary HA via Galera, with automated backups and point-in-time recovery. Image SHIPPED 2026-09-27 (1.18.0, 1.19.1, 1.20.0; it is also the pods' init image). Chart HELD: in the kind gate the operator creates the cluster and its init containers complete, but the Percona 8.4.8 database pod starts mysqld with wsrep provider none and never becomes ready, and it does the same with upstream's init image and with the 8.0 database image. Percona's forum reports the same failure in kind and minikube on Linux; the chart waits for a gate on a non-kind cluster." }, { "name": "MongoDB Community Operator", "category": "Databases & engines", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "MongoDB Community Kubernetes Operator: replica-set HA, automated failover, and TLS via CRDs. The operator is Apache-2.0; note the MongoDB server it deploys is SSPL (not OSI). Held 2026-10-07: the community operator repo is archived; its successor mongodb/mongodb-kubernetes (1.13.0, Apache-2.0 for Community clusters) runs every member beside mongodb-agent, a closed-source binary its Dockerfile downloads prebuilt (agent 109.0.1.9310-1), which cannot be built or scanned." }, { "name": "mongodb-ha-stack", "category": "Stacks", "license": "SSPL-1.0", "licenseClean": "caution", "priority": "exploring", "note": "Operator-based HA MongoDB: MongoDB Community Operator + a metrics exporter — replica-set failover. CRD-driven. The operator is Apache-2.0, but MongoDB itself is SSPL (not OSI), so the stack inherits that caution.", "cleanAlternative": "FerretDB (Apache-2.0) on the pg-ha-stack — a MongoDB-compatible, fully-open document database over PostgreSQL." }, { "name": "MinIO", "category": "Storage & platform", "license": "AGPL-3.0", "licenseClean": "agpl", "priority": "planned", "note": "S3-compatible object storage; relicensed to AGPL-3.0. Held 2026-10-08: minio/minio is archived (README: no longer maintained; the alternatives are the proprietary AIStor editions), last release RELEASE.2025-10-15T17-29-55Z. An archived server gets no CVE fixes. SeaweedFS, Garage, RustFS and Ceph (RGW) are the S3 options in the catalog.", "cleanAlternative": "SeaweedFS / Garage / RustFS (Apache-2.0), all already shipped." }, { "name": "Kaniko", "category": "Security & supply chain", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Build container images inside Kubernetes without a daemon. Held 2026-09-25: Google archived it in June 2025 (continued as osscontainertools/kaniko 1.28 and chainguard-dev/kaniko 1.25), and the executor unpacks image layers over its own root filesystem, so it must run as root, against the nonroot rule. BuildKit rootless is the likelier fit." }, { "name": "Dagger", "category": "Security & supply chain", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Programmable CI/CD engine that runs pipelines in containers. Sized 2026-09-27: the CLI is plain Go, but the engine image bundles runc, CNI plugins and the Go, Python and TypeScript SDK runtimes as builtin content that upstream builds with Dagger itself. A multi-day build; not started." }, { "name": "KubeVirt", "category": "CI/CD & registry", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Run virtual machines as Kubernetes workloads. Sized 2026-10-08 at v1.9.0: upstream assembles its images with Bazel from CentOS Stream 9 RPMs (libvirt, qemu-kvm, passt). Wolfi has qemu 11.1.2 but no libvirt or passt package, so virt-launcher needs both built from source alongside the Go components (virt-operator, virt-api, virt-controller, virt-handler); it waits for local gates." }, { "name": "Apicurio Registry", "category": "Messaging & streaming", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "API and schema registry for Kafka, Avro, and Protobuf. Measured 2026-09-25: the 3.3.3 app distribution carries 467 findings; 26 in-place jar swaps clear all but opentelemetry-api 1.57.0 (CVE-2026-45292, fixed only in 1.62.0), which adds packages the prebuilt Quarkus index cannot load. Needs a source build that regenerates the index." }, { "name": "Couchbase", "category": "Databases & engines", "license": "BSL-1.1", "licenseClean": "caution", "priority": "exploring", "note": "Distributed document database. Source-available, not OSI.", "cleanAlternative": "CouchDB (Apache-2.0), already shipped." }, { "name": "Aerospike", "category": "Databases & engines", "license": "AGPL-3.0", "licenseClean": "agpl", "priority": "exploring", "note": "Real-time key-value database; community edition is AGPL." }, { "name": "Liquibase", "category": "Databases & engines", "license": "FSL-1.1", "licenseClean": "caution", "priority": "planned", "note": "Database schema change and migration management. Relicensed: 5.x is under the Functional Source License 1.1 (source-available, Apache-2.0 two years after each release, competing use restricted); the last Apache-2.0 release is 4.33.0 and its line is no longer patched. Flyway (Apache-2.0) covers the same job." }, { "name": "Cortex", "category": "Observability", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Horizontally scalable, multi-tenant Prometheus storage. Held 2026-10-05: four prometheus/prometheus CVEs (two HIGH) are fixed only in 0.311.3 (Prometheus 3.11.3), but Cortex 1.21.1 is on 0.308.1 and imports tsdb/errors, removed in Prometheus 3.10; Cortex master is on 0.309.1 and still imports it. Unblocks when a Cortex release moves to Prometheus 3.11." }, { "name": "Kubeflow Pipelines", "category": "Machine learning", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "ML pipeline orchestration on Kubernetes. Partly built 2026-10-20 (2.17.2): api-server, persistence agent, scheduled workflow controller, driver, launcher and frontend images ship 0-CVE (images 405e86c8). The chart is held: v2 runs need the ML Metadata store server, whose binary (Wolfi 1.17.1, upstream 1.21.0) statically links sqlite 3.39.2, zlib 1.2.12, gRPC 1.46.3, MariaDB Connector/C 3.0.8 and libpq 12.1, invisible to the scanner. Unblock: an MLMD release on current libraries, or our own Bazel build against Wolfi system libraries." }, { "name": "TensorFlow Serving", "category": "Machine learning", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "High-performance serving system for TensorFlow models. Measured 2026-10-20 at 2.21.0: tensorflow_model_server is a Bazel build of all of TensorFlow (hours per arch, past the CI budget), and the official binary links TensorFlow, gRPC, protobuf and absl statically, so the scanner cannot read what is inside. Hold until a source build fits the CI budget." }, { "name": "AnythingLLM", "category": "Machine learning", "license": "MIT", "licenseClean": "clean", "priority": "exploring", "note": "Self-hosted chat-with-your-documents LLM application. Measured 2026-10-20 at v1.18.0: the upstream image scans 445 fixable npm findings in 61 packages, ships 24 native .node addons, and runs on Prisma's prebuilt Rust query engine (libquery_engine .so.node), which the scanner cannot read. Hold until a build with prisma-engines from source (cargo auditable) is sized." }, { "name": "XWiki", "category": "Apps & productivity", "license": "LGPL-2.1", "licenseClean": "clean", "priority": "exploring", "note": "Enterprise wiki and structured collaboration platform. Measured 2026-10-14 (17.10.13 LTS and 18.8.0): recipe written, held before CI. After safe jar swaps 8 fixable findings remain on both lines: bundled solr-core 9.4.1 (fixes need Solr 9.8 to 9.10.1, a whole Solr and Lucene jar set), the Jetty 10.0.26 client (fixes only on Jetty 11/12, no 10.x release) and opennlp-tools (fix only in 2.x). XWiki master still pins Solr 9.4.1. Unblocks with an XWiki release on Solr 9.10.1 or newer and a fixed Jetty client." }, { "name": "Rocket.Chat", "category": "Apps & productivity", "license": "MIT", "licenseClean": "clean", "priority": "planned", "note": "Self-hosted team chat platform backed by MongoDB. Measured 2026-10-20 at 8.9.0: the official build compiles apps/meteor/ee/ and ee/ (Rocket.Chat Enterprise license, not OSI) into the same Meteor bundle, so a clean MIT-only image means a source build with the ee packages removed; the upstream image also scans 160 fixable npm findings in 44 packages. Hold until a source build without ee/ is sized." }, { "name": "Cube", "category": "Workflow & data", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Semantic layer and analytics API over your data. Held 2026-10-20 (images apps/cube): the server needs the Rust addon @cubejs-backend/native, and a from-source build of 1.8.8 compiles flatbuffers 2.1.2 (CRITICAL), thrift 0.13.0 and lexical-core 0.8.5 from Cube's pinned 2022 arrow/datafusion forks. Unblock: a release that moves cubesql off those forks." }, { "name": "Chromium", "category": "Apps & productivity", "license": "BSD-3-Clause", "licenseClean": "clean", "priority": "exploring", "note": "Headless browser for rendering, scraping, and PDF export." }, { "name": "ai-stack", "category": "Stacks", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Ollama (or vLLM) + Open WebUI + Qdrant — self-hosted LLM serving, a chat UI, and a vector DB for retrieval-augmented generation. Qdrant is built; needs Ollama/vLLM + Open WebUI images." }, { "name": "analytics-stack", "category": "Stacks", "license": "Apache-2.0", "licenseClean": "clean", "priority": "exploring", "note": "Apache Superset + Trino + PostgreSQL — federated SQL analytics with self-service BI dashboards. PostgreSQL is built; needs Superset + Trino." }, { "name": "Higress", "category": "Gateways & proxies", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Alibaba's Istio+Envoy-based gateway. Two components (higress-core, higress-console) and it inherits Istio/Envoy build weight. Measured 2026-10-20 at v2.2.5: the gateway image runs Higress's own patched Envoy (a Bazel build, hours per arch, past the CI budget; same wall as Cilium Envoy) plus pilot-agent, and scans 163 Go findings; the controller scans 85 Go findings on top of 446 Ubuntu ones. The Go parts are buildable; the patched Envoy is the hold." }, { "name": "Apache ShenYu", "category": "Gateways & proxies", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Java API gateway. shenyu-bootstrap + shenyu-admin; admin needs a database. Held 2026-10-19: the 2.7.1 dists (trivy rootfs) carry 234 (admin) and 309 (bootstrap) fixable findings, 27 CRITICAL, on Spring Boot 3.3.1 / Spring 6.1.10 whose fixes sit in Boot 4 and Spring 7, plus Shiro 1.13 (fix 2.x), Tomcat 10.1.25 and fastjson 1.2.76; not jar-swappable. Unblock: an upstream release on a current Spring line." }, { "name": "Skipper", "category": "Gateways & proxies", "license": "UNVERIFIED", "licenseClean": "caution", "priority": "planned", "note": "Zalando's HTTP router. BLOCKING: GitHub reports NOASSERTION and the LICENSE fetch came back empty -- resolve the license before writing a recipe." }, { "name": "Cilium Envoy", "category": "Coordination & mesh", "license": "Apache-2.0", "licenseClean": "clean", "priority": "planned", "note": "Cilium's own patched Envoy; not reusable from our stock envoy image. Measured 2026-10-19: Wolfi packages only cilium-envoy-1.19 at 1.19.3, behind our cilium lines (1.18.15, 1.19.9, 1.20.3), and cilium/proxy builds Envoy with Bazel (hours per arch, past the CI budget). Hold until Wolfi tracks each cilium line; the cilium chart keeps L7 proxy off until then." }, { "name": "Consul Dataplane", "category": "Coordination & mesh", "license": "MPL-2.0", "licenseClean": "clean", "priority": "planned", "note": "Envoy-based sidecar for Consul. MPL, so cleaner than the BUSL server." }, { "name": "Consul K8s Control Plane", "category": "Coordination & mesh", "license": "MPL-2.0", "licenseClean": "clean", "priority": "planned", "note": "The operator that makes Consul work on Kubernetes." } ] }