minimal

138 small, hardened container images. Free, MIT-licensed, signed, and rebuilt daily.

Browse the catalog →

---

Quick start

docker pull ghcr.io/rtvkiz/minimal-python:latest

No account needed. Every image has a :latest-dev companion with a shell and toolchain for debugging and multi-stage builds.

docker run --rm -p 8080:80 ghcr.io/rtvkiz/minimal-nginx:latest
docker run --rm -p 6379:6379 ghcr.io/rtvkiz/minimal-redis-slim:latest

Find an image → — all 138, with live sizes and CVE counts.

Verify what you pulled

gh attestation verify oci://ghcr.io/rtvkiz/minimal-python:latest --owner rtvkiz

Every published image carries a keyless Cosign signature, an SPDX SBOM, and SLSA v1.0 build provenance tied to the workflow and commit that produced it.

Signature, SBOM, and provenance commands →

What makes these different

• Small and shell-less — production images ship no /bin/sh where the application permits it, and run as non-root by default.
• Built from source — public, readable melange recipes, not a repackaged base image. Native amd64 and arm64.
• Never stale — rebuilt daily against current Wolfi packages; upstream releases and transitive CVEs open their own auto-merging PRs.
• Verifiable — signed, with SBOM and provenance attached to every digest.

No vendor SLA, support contract, or FedRAMP/FIPS/STIG accreditation. The signatures, SBOMs, and provenance help with verification and audits; they do not replace those programs.

Pinning

FROM ghcr.io/rtvkiz/minimal-python@sha256:<digest>   # immutable
FROM ghcr.io/rtvkiz/minimal-python:3                 # patched, no major jumps

:latest crosses major versions; an exact version tag never moves at all.

Tags and pinning →

On vulnerability counts

A green build does not mean zero findings. Grype scans every production image and results are informational — they do not block publication. The catalog shows raw and VEX-effective counts side by side, and suppressions are reconciled against each fresh scan so they cannot quietly go stale.

Reading scan results →

Contributing

make python && make test-python                       # apko-only image
make caddy-melange && make caddy && make test-caddy   # source-built image

PRs welcome. CONTRIBUTING.md covers tooling and layout; docs/onboarding.md is the complete checklist for adding an image; docs/roadmap.md is the demand-ranked backlog.

Security issues: please use private vulnerability reporting rather than a public issue.

License

MIT — see LICENSE. Images include Wolfi and upstream packages under their own licenses; each image's SPDX SBOM has the details.