cloudnative-pgDatabases

Shell-less CloudNativePG Postgres operator, built from source via melange.

Arch x86_64, aarch64User nonroot (65532)Upstream cloudnative-pg.io

Pull this image

docker pull ghcr.io/rtvkiz/minimal-cloudnative-pg:latest

Details

Repository: ghcr.io/rtvkiz/minimal-cloudnative-pg
Architectures: x86_64, aarch64
Primary package: cloudnative-pg

Some data was unavailable for this build: partial.

Entrypoint

/manager

User

nonroot (65532)

Working dir

Architectures

x86_64, aarch64

Environment

Labels

org.opencontainers.image.title	minimal-cloudnative-pg
org.opencontainers.image.description	Hardened shell-less CloudNativePG operator built from source via melange with CVE patches on every rebuild
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/cloudnative-pg
org.opencontainers.image.licenses	Apache-2.0

Tag	Pull	Published
1	ghcr.io/rtvkiz/minimal-cloudnative-pg:1	2026-10-29
1.30	ghcr.io/rtvkiz/minimal-cloudnative-pg:1.30	2026-10-29
1.30.1-r0	ghcr.io/rtvkiz/minimal-cloudnative-pg:1.30.1-r0	2026-10-29
1.30.1-r0-20261029	ghcr.io/rtvkiz/minimal-cloudnative-pg:1.30.1-r0-20261029	2026-10-29
latest	ghcr.io/rtvkiz/minimal-cloudnative-pg:latest	2026-10-29
1-dev	ghcr.io/rtvkiz/minimal-cloudnative-pg:1-dev	2026-10-29
1.30-dev	ghcr.io/rtvkiz/minimal-cloudnative-pg:1.30-dev	2026-10-29
1.30.1-r0-20261029-dev	ghcr.io/rtvkiz/minimal-cloudnative-pg:1.30.1-r0-20261029-dev	2026-10-29
1.30.1-r0-dev	ghcr.io/rtvkiz/minimal-cloudnative-pg:1.30.1-r0-dev	2026-10-29
latest-dev	ghcr.io/rtvkiz/minimal-cloudnative-pg:latest-dev	2026-10-29
1.30.1-r0-20261028	ghcr.io/rtvkiz/minimal-cloudnative-pg:1.30.1-r0-20261028	2026-10-28
1.30.1-r0-20261028-dev	ghcr.io/rtvkiz/minimal-cloudnative-pg:1.30.1-r0-20261028-dev	2026-10-28

The resolved SBOM isn't available for this build yet — showing the packages requested in the apko build recipe (without resolved versions). The full SBOM appears after the next scheduled build.

No scan data for this build. Advisories appear after the next scheduled CVE scan.

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-cloudnative-pg:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-cloudnative-pg:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-cloudnative-pg:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Databases images

Weighing this against another provider? Thecomparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read themigration guide for what actually breaks when you switch.

org.opencontainers.image.title	minimal-cloudnative-pg-dev
org.opencontainers.image.description	Dev variant of minimal-cloudnative-pg: same binary + shell + debugging tools. Not for production.
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/cloudnative-pg
org.opencontainers.image.licenses	Apache-2.0
dev.minimal.variant	dev