Images

433 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 433 available now.

D 10
trufflehog
TruffleHog, the secret scanner for git history, filesystems, S3, Docker images and more. Built from source (static Go) with git and ssh included for…
v3.99.365.0 MB3 versions
Security & supply chainstandardAGPL-3.0
A 3
trust-manager
trust-manager, cert-manager's trust bundle distributor. A Bundle resource gathers CA certificates from ConfigMaps, Secrets and inline PEM and writes…
v0.25.012.0 MB3 versions
Security & supply chainstandardApache-2.0
D 10
tyk
Full-featured API gateway with rate limiting, auth, and quotas. Single static Go binary on a hardened nonroot Wolfi base; Redis is a runtime…
v5.15.192.5 MB2 versions
GatewaystandardMPL-2.0
A+
typesense
Fast, typo-tolerant search engine with an instant-search REST API and a self-contained embedded store (no external database), tuned for low-latency…
v30.2147.5 MB3 versions
SearchstandardGPL-3.0
A+
unbound
Unbound, the validating, recursive, caching DNS resolver from NLnet Labs. Built from source with libevent, expat and dnscrypt; a nonroot config on…
v1.26.216.5 MB
CoordinationstandardBSD-3-Clause
D 12
unleash
Unleash, the feature-flag and gradual-rollout server (flags, strategies, segments, environments, admin UI, client and frontend APIs) on PostgreSQL.…
v8.2.181.9 MB3 versions
Apps & productivitystandardAGPL-3.0+
D 17
uptime-kuma
Uptime Kuma, the self-hosted uptime monitor and status-page server (HTTP, TCP, ping, DNS, database and more). The tagged server with pinned npm…
v2.5.6108.0 MB
ObservabilitystandardMIT
D 9
uv
Python base image with uv, a fast Rust-based installer and resolver, used as the build stage for Python projects. Line 0.11.
v0.13.543.3 MB2 versions
Build toolstandardMIT OR Apache-2.0
A+
Valkey
BSD-licensed in-memory key-value store, the truly-open community fork of Redis 7.2. QuenchWorks' default cache and the recommended Redis drop-in…
v9.1.215.8 MB3 versions
CachecriticalBSD-3-Clause
A+
varnish
HTTP reverse-proxy cache (web accelerator) that fronts an origin and serves its responses from memory, cutting backend load and tail latency. Caching…
v9.1.0203.5 MB3 versions
CachestandardBSD-2-Clause
D 10
vault
Secrets and encryption management for tokens, keys, and certificates, with dynamic secrets, leasing, and PKI. Shipped under the Business Source…
v2.1.296.2 MB2 versions
SecretslowBUSL-1.1
D 21
vcluster
vCluster, virtual Kubernetes clusters that run inside a namespace of a host cluster. The syncer is built from source (CGO off, floated modules); the…
v0.37.4113.6 MB3 versions
CI/CD & registrystandardApache-2.0