mastodon

Chart · Apps & productivity · standard · v0.0.19

digest pinnedcosign signedSPDX SBOMSLSA provenanceamd64 · arm64Rebuilt 2026-10-22

Mastodon, the federated social network server (web and sidekiq). Built from the release tag on a hardened Wolfi ruby-4.0 runtime with every gem compiled from source against Wolfi's libvips, libpq, ICU and libxml2, and the web assets compiled at build time, so no Node ships at runtime. Nonroot, read-only rootfs; PostgreSQL and Redis are external. The streaming server is a separate image.

Version

0.0.19 · latest 0.0.18 0.0.17

The latest line lives at the base page; older lines have their own page so you can pin and verify exactly that version. Only the most recent releases are listed — an older chart pins an older image digest.

Deployed image digest

sha256:75985a180d492ab536e7b4407b660326660e4a0e9cdec7942c23e526b8fdca33

Chart OCI version

oci://ghcr.io/quenchworks/charts/mastodon:0.0.19

The chart pins its image by this signed digest, so you never track it yourself. Signatures, SBOM, and provenance attach to the same digest.

Signed

cosign keyless

SBOM

SPDX, on image

Provenance

SLSA build

Architectures

amd64, arm64

Runs as

nonroot (uid 1001)

Root filesystem

read-only

Image size

340.1 MB

Security report (Trivy)

D· 29/1008 fixable · rebuild clears them

Vulnerability detail

mastodon 4.7.3 · 8 CVE

CVE	Severity	Package	Installed	Fixed in	Title
GHSA-5v64-555j-wjxm	HIGH	rack	3.2.7	~> 2.2.25, ~> 3.1.23, >= 3.2.8	Multipart parser retains parsed data in its scan buffer, allowing denial of service via memory exhaustion.
CVE-2026-116695	MEDIUM	crass	1.0.7	1.0.8	crass: crass: CSS injection via malformed URL token parsing
GHSA-2j8w-xcrc-x985	MEDIUM	rack	3.2.7	~> 3.1.23, >= 3.2.8	Rack::Request#host_with_port and `#base_url` return an invalid `Host` verbatim, enabling URL and allowlist bypass
GHSA-5287-hmjh-qmqq	MEDIUM	pghero	4.0.1	>= 4.1.0	Insecure direct object reference (IDOR)
GHSA-wvg4-6p58-3gh3	MEDIUM	rack	3.2.7	~> 2.2.25, ~> 3.1.23, >= 3.2.8	Rack::Static `header_rules` bypass via unnormalized dot segments in the request path
GHSA-p8x9-v4hv-2w4g	LOW	rack	3.2.7	~> 2.2.25, ~> 3.1.23, >= 3.2.8	Multipart boundary guard skips a leading empty or quoted `boundary` parameter, allowing parser differentials and WAF bypass
GHSA-pq4g-8rxf-4g29	UNKNOWN	crass	1.0.7	>= 1.0.8	Incorrect tokenization of bad URLs enables CSS sanitizer bypass
GHSA-wgw9-qhqg-8hv5	UNKNOWN	sanitize	7.0.0	>= 7.0.1	CSS property and URL allowlists can be bypassed via CSS nesting in stylesheets

Critical

High

Medium

Low

Unknown

Security report (Trivy) · image mastodon 4.7.3

Install the chart

Deploy to Kubernetes with hardened defaults. The chart pins its image by signed digest, so you never track it yourself.

Install (latest)

helm install my-mastodon oci://ghcr.io/quenchworks/charts/mastodon --version 0.0.19

Deploys images (digest-pinned)

mastodon4.7.3
D
ghcr.io/quenchworks/images/mastodon@sha256:75985a180d492ab536e7b4407b660326660e4a0e9cdec7942c23e526b8fdca33
mastodon-streaming4.7.3
D
ghcr.io/quenchworks/images/mastodon-streaming@sha256:f3befe71fe6d3bdbc64f20dc119a716719de340070c0fb3cc3e978889f93cece
postgresql18.6
D
ghcr.io/quenchworks/images/postgresql@sha256:42316ed44fa7722f611c35af6edb37882ceaac8c83f48a59735d329d5c12d977
valkey9.1.2
A+
ghcr.io/quenchworks/images/valkey@sha256:22b644a4aaef49828a48d2cc0b1753cf7a950dc6315dc2d34731012e2326ec4d

Chart version: 0.0.19
App version: 4.7.3
Chart license: AGPL-3.0-only
App license: AGPL-3.0
Service port: 3000
Signed: cosign (keyless)
Values schema: yes
Last published: 2026-10-22

Values keys

image: repository digest pullPolicy
streaming: image replicaCount resources
nameOverride
localDomain
webDomain
registrationsMode
secrets: existingSecret
web: replicaCount resources
sidekiq: replicaCount extraArgs resources
extraEnvVars
extraEnvVarsCM
extraEnvVarsSecret
postgresql: enabled auth primary
externalDatabase: host port database username password existingSecret existingSecretPasswordKey
valkey: enabled auth
externalRedis: host port password existingSecret existingSecretPasswordKey
waitForDatabase: image
persistence: enabled size storageClass accessModes existingClaim
service: type port streamingPort
ingress: enabled className annotations host tls
podLabels
podAnnotations
nodeSelector
affinity
tolerations
topologySpreadConstraints
priorityClassName
schedulerName
terminationGracePeriodSeconds
podSecurityContext
containerSecurityContext
serviceAccount: create name annotations
networkPolicy: enabled allowExternal
podDisruptionBudget: enabled minAvailable

Verify the chart

cosign verify ghcr.io/quenchworks/charts/mastodon:0.0.19 \
  --certificate-identity-regexp 'https://github.com/quenchworks/.+' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Transparency

The chart publishes its attestations on GitHub and the image it deploys carries its own on the same digest, publicly verifiable with the commands above. Both log to the Sigstore transparency log (Rekor), which cosign verify checks for you.

View the image View on ArtifactHub Chart source

Upstream project: https://joinmastodon.org