Container image catalog
Images I build, scan and publish. Select a URI to copy it. The build approach is written up in the distroless notes.
-
jre-distroless-25
Eclipse Temurin 25 LTS, jlink-trimmed, on a Chainguard Wolfi glibc-dynamic base. No shell, no package manager, non-root. Trivy reports zero CVEs at every severity; rebuilt daily so the base stays patched. amd64 and arm64, ~46 MB to pull.
-
jre-distroless-21
The same zero-CVE distroless JRE built against Temurin 21 LTS. amd64 and arm64, ~44 MB to pull.
-
jre-distroless-17
The same zero-CVE distroless JRE built against Temurin 17 LTS, for services still on the older runtime. amd64 and arm64, ~40 MB to pull.
-
nginx-distroless
nginx compiled statically with ModSecurity v3 and the OWASP Core Rule Set, on a Chainguard static base. The WAF is switched on at runtime with IS_MS_ON=true. Runs as uid 65532 on port 8080 and works with a read-only filesystem. ~7 MB to pull.
-
nodejs-distroless-24-runtime
Node.js 24 runtime: the node binary and its shared libraries on Wolfi glibc-dynamic, nothing else. Non-root, no shell. Rebuilt nightly behind a Trivy gate that fails the build on a CVE of any severity. ~41 MB to pull.
-
nodejs-distroless-24-builder
Build stage for Node.js 24: node, npm, node-gyp, gcc, make, python-3 and git on wolfi-base. Pair it with the matching runtime image in a multi-stage build; it is not meant to ship.
-
nodejs-distroless-22-runtime
The same distroless Node.js runtime built against Node.js 22. ~40 MB to pull.
-
nodejs-distroless-22-builder
Build stage for Node.js 22, matching the 22 runtime image.