Shell-less Python 3 runtime built on Wolfi.
Open source · MIT licensed
Hardened container images
Free. Signed. Verifiable. Small images built from source and rebuilt every six hours — each one cosign-signed with an SPDX SBOM and SLSA Level 3 provenance. No account, no rate limits.
96
Images
L3
SLSA provenance
6h
Rebuild cadence
$0
Cost
Pull and verify in 30 seconds
You don't have to trust us — check the provenance yourself.
# Pull — public, no login, no rate limit
docker pull ghcr.io/rtvkiz/minimal-python:latest
# Verify build provenance (SLSA L3)
gh attestation verify oci://ghcr.io/rtvkiz/minimal-python:latest --owner rtvkizWhat every image ships with
Signed, scanned, and reproducible — the same guarantees on every tag.
Cosign keyless signature
Verifiable against the public Rekor transparency log — no keys to manage.
SPDX SBOM attestation
Every package, version and license, attached as an in-toto attestation.
SLSA v1.0 provenance
Cryptographic proof of which workflow, commit and runner built the image.
Daily CVE scans
Grype results published here and in the GitHub Security tab.
Non-root by default
Runs as UID 65532 unless the upstream insists otherwise.
No shell where possible
Most images don't ship /bin/sh, shrinking the attack surface.
Popular images
A few of the 96 available. See all →
Shell-less Node.js runtime built on Wolfi.
Go builder image built on Wolfi.
Shell-less Nginx built on Wolfi.
PostgreSQL built on Wolfi.
Shell-less Redis built from source via melange.