Images

405 images

Hardened container images

Every image is built from source on Wolfi, scanned to zero fixable CVEs, cosign-signed, and pinned by digest, with an SPDX SBOM and a SLSA build-provenance attestation you can verify. Nonroot, read-only rootfs, amd64 + arm64. 405 available now.

A 2
spire
SPIRE, the SPIFFE runtime that attests nodes and workloads and issues them short-lived X.509 and JWT identities (spire-server and spire-agent in one…
v1.15.367.7 MB
IdentitystandardApache-2.0
A+
squid
Caching forward proxy for HTTP and HTTPS (CONNECT). Pods reach the outside through it, and it caches repeat fetches in memory. The default config…
v7.619.7 MB
CachestandardGPL-2.0+
A+
static
Tiny static base for self-contained binaries from Go or Rust. Nonroot, no shell, no package manager. The only image tagged :latest.
v20260621593.6 KB
Runtime basestandardMIT
A 2
step-ca
Online private certificate authority and ACME server for issuing X.509 and SSH certificates. Single static Go binary on a hardened nonroot Wolfi…
v0.30.229.9 MB
Security & supply chainstandardApache-2.0
A 1
step-issuer
step-issuer, smallstep's cert-manager external issuer. StepIssuer and StepClusterIssuer resources sign cert-manager CertificateRequests through a…
v0.12.018.4 MB3 versions
Security & supply chainstandardApache-2.0
A+
storm
Apache Storm, a distributed real-time stream processing system; one image runs Nimbus, the supervisor, the UI and the log viewer.
v3.1.0302.3 MB
MessagingstandardApache-2.0
0 CVE
strimzi-kafka
Strimzi's Kafka image, the one the Strimzi operator runs brokers, controllers, Connect, Cruise Control and Kafka Exporter from. Kafka with Strimzi's…
MessagingstandardApache-2.0
A+
strimzi-operator
Strimzi, the Kubernetes operator that runs and manages Apache Kafka clusters, topics and users. One image carries the cluster operator, topic…
v1.2.0158.5 MB
MessagingstandardApache-2.0
A 1
support-bundle-kit
Rancher's support-bundle-kit, which Longhorn and Harvester run to collect cluster objects, logs and node files into a support bundle. Built from…
v0.0.9853.9 MB3 versions
Storage & platformstandardApache-2.0
A 1
syft
Anchore's CLI for generating Software Bills of Materials (SBOMs) from container images and filesystems. Image only, no chart.
v1.54.128.9 MB
Security & supply chainstandardApache-2.0
A 3
tailscale
Tailscale node (tailscaled, the tailscale CLI and containerboot), the WireGuard mesh VPN client. Upstream's container layout and TS_* environment;…
v1.102.527.0 MB3 versions
Coordination & meshstandardBSD-3-Clause
A 3
tekton
Kubernetes-native CI/CD pipelines. Ships the Tekton Pipelines controller, webhook, resolvers, and pod-injected helper binaries, built from source on…
v1.17.0118.4 MB
CI/CD & registrystandardApache-2.0