kube-rbac-proxy

Docker Hardened Image

a small HTTP proxy for a single upstream, that can perform RBAC authorization against the Kubernetes API using SubjectAccessReview.

Sealed Secrets Controller Helm chart

Docker Hardened Image

Sealed Secrets is a Kubernetes controller and tool for one-way encrypted Secrets.

lacework/datacollector

Lacework Inc

Lacework is cloud security for AWS, Azure, GCP and other public and private cloud.

OAuth2 Proxy

Docker Hardened Image

A reverse proxy that provides authentication using OAuth2 and OIDC providers.

Goldilocks Helm chart

Docker Hardened Image

A Kubernetes utility to identify optimal resource requests and limits using Vertical Pod Autoscalers.

nginxinc/nginx-unprivileged

NGINX Inc.

Unprivileged NGINX Dockerfiles

OpenFGA

Docker Hardened Image

OpenFGA is an open source Fine Grained Authorization solution that implements Google's Zanzibar paper, helping you manage complex authorization rules in your applications.

dynatrace/oneagent

Dynatrace

Non-immutable installer image for Dynatrace OneAgent

Grype

Docker Hardened Image

Grype is a vulnerability scanner for container images and filesystems. It provides fast and accurate vulnerability detection with support for multiple package ecosystems and output formats.

Open Policy Agent

Docker Hardened Image

OPA is a policy engine that streamlines policy management across your stack for improved development, security and audit capability.

Syft

Docker Hardened Image

Syft is a CLI tool and Go library for generating Software Bill of Materials (SBOM) from container images and filesystems with support for multiple output formats and package ecosystems.

Dex

Docker Hardened Image

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

TruffleHog

Docker Hardened Image

TruffleHog is a secrets scanning tool that finds credentials, API keys, and sensitive data in git repositories, filesystems, S3 buckets, and more. Written in Go.

Kyverno CLI

Docker Hardened Image

The Kyverno Command Line Interface (CLI) is designed to validate and test policy behavior to resources prior to adding them to a cluster.

SonarQube

Docker Hardened Image

SonarQube is a self-managed, automatic code review tool that systematically helps you deliver clean code.

docker/ucp-auth

Docker, Inc.

Please refer to the docker/ucp image for more information

Harbor Registry

Docker Hardened Image

Docker Distribution registry for storing and distributing container images within Harbor

notation

Docker Hardened Image

Notation is a CLI tool for signing and verifying OCI artifacts with trust policies and plugin-based key management.

Vault Helm chart

Docker Hardened Image

Vault is a tool for securely accessing secrets.

OAuth2 Proxy Helm chart

Docker Hardened Image

A reverse proxy that provides authentication using OAuth2 and OIDC providers.

Tailscale

Docker Hardened Image

Tailscale lets you securely connect devices and containers without exposing them to the public internet.

netdata/netdata

Netdata

The official image for monitoring systems, containers and applications with Netdata.

Kyverno Readiness Checker

Docker Hardened Image

Kyverno Readiness Checker is a component that checks the readiness of a Kyverno installation

Polaris

Docker Hardened Image

Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the command line or as a mutating webhook, Polaris can automatically remediate issues based on policy criteria.

kube-mgmt

Docker Hardened Image

Sidecar for managing OPA instances in Kubernetes.

Kyverno Helm chart

Docker Hardened Image

Kyverno is a Kubernetes Native Policy Management engine.

Trivy Operator

Docker Hardened Image

Kubernetes-native security toolkit that leverages Trivy to continuously scan your Kubernetes cluster for security issues.

Dex Helm chart

Docker Hardened Image

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors