Small, hardened container images, free and MIT-licensed.
Built with Chainguard's apko, melange, and Wolfi packages; rebuilt every six hours.
Production images are signed and published with SPDX SBOM and SLSA build-provenance attestations.

Browse the live image catalog at minimalcontainers.com →

Verify an image · All 91 images · Update model · Build locally

Public images are available from GHCR without an account:

docker pull ghcr.io/rtvkiz/minimal-python:latest

Verify the GitHub build provenance:

gh attestation verify \
  oci://ghcr.io/rtvkiz/minimal-python:latest \
  --owner rtvkiz

Verify the keyless Cosign signature:

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-python:latest

Download the attached SPDX SBOM attestation:

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-python:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate' \
  > python-sbom.spdx.json

More verification examples and the vulnerability-reporting policy are in .github/SECURITY.md.

• Public, readable build recipes for every image.
• Native linux/amd64 and linux/arm64 packages and images.
• A keyless Cosign signature for each published image digest.
• SPDX SBOM attestations for the published architectures and image index.
• SLSA v1.0 build provenance tied to the GitHub workflow and commit.
• Grype reports in the live catalog and GitHub Security tab.
• Non-root execution by default, except where an upstream application requires another user model.
• Shell-less production images where the application permits it.
• A :latest-dev companion for every production image.
• Six-hour rebuilds to consume current Wolfi packages and security fixes.
• Automated application-version and transitive-dependency update PRs.

The project does not provide a vendor SLA, an on-call support contract, or FedRAMP/FIPS/STIG accreditation. The signatures, SBOMs, and provenance help with verification and audits, but do not replace those programs.

The inventory below is derived from catalog.json, which is validated against the build matrix in CI.

Live versions, image sizes, CVE results, packages, digests, and verification data are available at minimalcontainers.com.

# Python application
docker run --rm -v "$PWD:/app" \
  ghcr.io/rtvkiz/minimal-python:latest /app/main.py

# Nginx web server
docker run --rm -p 8080:80 \
  ghcr.io/rtvkiz/minimal-nginx:latest

# PostgreSQL
docker run --rm -p 5432:5432 -v pgdata:/var/lib/postgresql/data \
  ghcr.io/rtvkiz/minimal-postgres-slim:latest

# Redis
docker run --rm -p 6379:6379 \
  ghcr.io/rtvkiz/minimal-redis-slim:latest

# Caddy version
docker run --rm --entrypoint /usr/bin/caddy \
  ghcr.io/rtvkiz/minimal-caddy:latest version

Pin production deployments by digest when you need an immutable artifact:

FROM ghcr.io/rtvkiz/minimal-python@sha256:<digest>

Published tags serve different purposes:

The Melange epoch resets to r0 on an upstream application-version bump. It increments when the recipe itself changes while the upstream version stays the same.

All 91 images publish a :latest-dev companion. Prod and dev consume the same primary package from the same build; the dev image adds a shell, package manager, and image-appropriate build or debugging tools.

Dev variants are intended for multi-stage builds and in-cluster debugging, not production workloads:

FROM ghcr.io/rtvkiz/minimal-ruby:latest-dev AS build
WORKDIR /work
COPY Gemfile Gemfile.lock ./
RUN bundle install

FROM ghcr.io/rtvkiz/minimal-ruby:latest
COPY --from=build /work /work

Dev images retain the production entrypoint. Override it for an interactive shell:

docker run -it --entrypoint /bin/sh \
  ghcr.io/rtvkiz/minimal-caddy:latest-dev

Dev images use the same signing, SBOM, provenance, and publish pipeline as prod. They are not included in the public CVE dashboard because their intentionally larger toolchain surface is not representative of the production image. Composition rules are documented in docs/dev-variants/CONVENTIONS.md.

Image maintenance uses separate loops because rebuilding an image and upgrading its application are different operations.

build.yml rebuilds the complete catalog every six hours. It keeps the currently pinned application version but consumes current Wolfi packages, toolchains, and any dependency-patch block already stored in the recipe.

For a source-built image, the pipeline is:

verified source archive
  → native x86_64 and ARM64 Melange packages
  → production and dev Apko images
  → smoke test and production-image Grype scan
  → multi-architecture publish
  → Cosign signature, SPDX SBOM, and SLSA provenance
  → verification and catalog artifacts

Pull requests build and test but do not publish. Only trusted non-PR runs publish to GHCR.

update-versions.yml checks 80 source-built applications daily using the declarative registry in .github/versions.yaml. It updates the application version, verifies the upstream artifact checksum, resets the epoch, opens a PR, and enables auto-merge after required checks pass.

Major-version pins stop unattended breaking upgrades. A new major can create an issue for explicit review instead.

MinIO's date-based release tags are handled separately by update-minio.yml.

For package-based images:

• Rolling Wolfi package names (nginx-mainline, apache2, sqlite, bun) advance through the six-hour rebuild.
• Versioned Wolfi package families (Python, Go, Node.js, .NET, Java, PostgreSQL) receive patch releases through rebuilds, while update-wolfi-packages.yml opens PRs when the package family itself must change.

CI enforces complete update coverage using .github/autoupdate-coverage.yaml.

patch-go-deps.yml scans published Go binaries every six hours and proposes targeted module updates for fixable vulnerabilities. It preserves existing security pins, harmonizes related module families, and uses compile-before-keep checks for dependency-sensitive applications.

patch-deps.yml performs the corresponding work for:

• Rails gems.
• Qdrant Rust crates.
• Keycloak Maven dependencies.
• Bundled Java archives in OpenSearch and Keycloak.

Cassandra, Solr, and Pulsar bundled-JAR findings are report-only until their tightly coupled dependency families receive an explicit compatibility review.

Generated changes are committed to automated PRs. The normal image build is the integration gate before auto-merge.

A successful build does not mean an image has zero reported vulnerabilities.

• Grype scans production images and publishes raw JSON and SARIF results.
• OpenVEX documents can mark a finding not_affected or fixed with justification.
• The catalog shows both raw and VEX-effective counts.
• VEX documents are schema-validated, and stale or newly fixable statements produce drift warnings.
• Vulnerability findings are currently informational; the build has no global severity threshold that blocks publication.
• Dev images are intentionally excluded from the public CVE dashboard.

See tools/vex/README.md for the VEX workflow.

Install the same major tools used by CI:

go install chainguard.dev/apko@v1.1.6
go install chainguard.dev/melange@v0.41.1
brew install anchore/grype/grype

Build and test an Apko-only image:

make python
make test-python

Build and test a source-built image:

make caddy-melange
make caddy
make test-caddy

The authoritative onboarding and pre-push checklist is in docs/onboarding.md. See the Makefile for all local targets.

minimal/
├── <image>/
│   ├── apko/<name>.yaml          # production image assembly
│   ├── apko/<name>-dev.yaml      # development/debug variant
│   ├── melange.yaml              # source build, when applicable
│   ├── test.sh                   # production smoke test
│   └── test-dev.sh               # development-variant smoke test
├── vex/<name>.openvex.json       # per-image vulnerability statements
├── .github/
│   ├── versions.yaml             # source-version update registry
│   ├── patch-deps.yaml           # non-Go dependency patch registry
│   ├── autoupdate-coverage.yaml  # package-based update classification
│   ├── scripts/                  # shared updater implementation
│   └── workflows/                # build, update, security, site, and cleanup automation
├── catalog.json                  # canonical public image inventory
├── docs/                         # onboarding, update, and variant standards
├── site/                         # minimalcontainers.com Astro site
├── Makefile
└── README.md

PRs are welcome. Start with CONTRIBUTING.md, then use docs/onboarding.md for the complete image registration and validation checklist. The demand-ranked image backlog is in docs/roadmap.md.

For security issues, use GitHub private vulnerability reporting instead of opening a public issue.

The repository is MIT-licensed; see LICENSE. Container images include Wolfi and upstream packages under their respective licenses. Package and license details are available in each image's attached SPDX SBOM.