envoy
Envoy L7 proxy and service-mesh data plane with gRPC and observability built in. Shell-less image, cosign-signed and SBOM-attested, rebuilt daily.
- Vulnerabilities
- None
- Compressed size
- 42 MB
- Architectures
- amd64, arm64
- Default user
- nonroot (65532)
- Last built
- today
- Upstream
- www.envoyproxy.io
Pull this image
docker pull ghcr.io/rtvkiz/minimal-envoy:latestdocker pull ghcr.io/rtvkiz/minimal-envoy:latest-devThe -dev variant adds a shell, package manager and build toolchain. For CI and debugging — not production.
- Repository
- ghcr.io/rtvkiz/minimal-envoy
- Digest
- sha256:6d998e4e84f1254027412e9c790887f170f1f13ed8f081609a0117fe79fa4a0d
- Built at
- 2026-11-12T08:06:02Z
- Primary package
- envoy
- Entrypoint
- /usr/bin/envoy
- User
- nonroot (65532)
- Working dir
- /
- Architectures
- x86_64, aarch64
- Environment
- Labels
-
org.opencontainers.image.title minimal-envoy org.opencontainers.image.description Hardened shell-less Envoy proxy image org.opencontainers.image.url https://github.com/rtvkiz/minimal org.opencontainers.image.source https://github.com/rtvkiz/minimal/tree/main/images/envoy org.opencontainers.image.licenses Apache-2.0
- Entrypoint
- /usr/bin/envoy
- User
- nonroot (65532)
- Working dir
- /
- Architectures
- x86_64, aarch64
- Environment
- Labels
-
org.opencontainers.image.title minimal-envoy-dev org.opencontainers.image.description Dev variant of minimal-envoy: same envoy + shell + curl/openssl/dig/jq. Not for production. org.opencontainers.image.url https://github.com/rtvkiz/minimal org.opencontainers.image.source https://github.com/rtvkiz/minimal/tree/main/images/envoy org.opencontainers.image.licenses Apache-2.0 dev.minimal.variant dev
| Tag | Pull | Published |
|---|---|---|
| 1 | ghcr.io/rtvkiz/minimal-envoy:1 | 2026-11-12 |
| 1.40 | ghcr.io/rtvkiz/minimal-envoy:1.40 | 2026-11-12 |
| 1.40.2-r0 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0 | 2026-11-12 |
| 1.40.2-r0-20261112 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261112 | 2026-11-12 |
| latest | ghcr.io/rtvkiz/minimal-envoy:latest | 2026-11-12 |
| 1-dev | ghcr.io/rtvkiz/minimal-envoy:1-dev | 2026-11-12 |
| 1.40-dev | ghcr.io/rtvkiz/minimal-envoy:1.40-dev | 2026-11-12 |
| 1.40.2-r0-20261112-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261112-dev | 2026-11-12 |
| 1.40.2-r0-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-dev | 2026-11-12 |
| latest-dev | ghcr.io/rtvkiz/minimal-envoy:latest-dev | 2026-11-12 |
| 1.40.2-r0-20261111-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261111-dev | 2026-11-11 |
| 1.40.2-r0-20261111 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261111 | 2026-11-11 |
| 1.40.2-r0-20261110 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261110 | 2026-11-10 |
| 1.40.2-r0-20261110-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261110-dev | 2026-11-10 |
| 1.40.2-r0-20261109 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261109 | 2026-11-09 |
| 1.40.2-r0-20261109-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261109-dev | 2026-11-09 |
| 1.40.2-r0-20261108 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261108 | 2026-11-08 |
| 1.40.2-r0-20261108-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261108-dev | 2026-11-08 |
| 1.40.2-r0-20261107 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261107 | 2026-11-07 |
| 1.40.2-r0-20261107-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261107-dev | 2026-11-07 |
| 1.40.2-r0-20261106 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261106 | 2026-11-06 |
| 1.40.2-r0-20261106-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261106-dev | 2026-11-06 |
| 1.40.2-r0-20261105 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261105 | 2026-11-05 |
| 1.40.2-r0-20261105-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261105-dev | 2026-11-05 |
| 1.40.2-r0-20261104 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261104 | 2026-11-04 |
| 1.40.2-r0-20261104-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261104-dev | 2026-11-04 |
| 1.40.2-r0-20261027 | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261027 | 2026-10-27 |
| 1.40.2-r0-20261027-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.2-r0-20261027-dev | 2026-10-27 |
| 1.40.1-r0 | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0 | 2026-10-27 |
| 1.40.1-r0-20261027 | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261027 | 2026-10-27 |
| 1.40.1-r0-20261027-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261027-dev | 2026-10-27 |
| 1.40.1-r0-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-dev | 2026-10-27 |
| 1.40.1-r0-20261026 | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261026 | 2026-10-26 |
| 1.40.1-r0-20261026-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261026-dev | 2026-10-26 |
| 1.40.1-r0-20261025-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261025-dev | 2026-10-25 |
| 1.40.1-r0-20261025 | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261025 | 2026-10-25 |
| 1.40.1-r0-20261024-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261024-dev | 2026-10-24 |
| 1.40.1-r0-20261024 | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261024 | 2026-10-24 |
| 1.40.1-r0-20261023 | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261023 | 2026-10-23 |
| 1.40.1-r0-20261023-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.1-r0-20261023-dev | 2026-10-23 |
| 1.40.0-r0 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0 | 2026-10-23 |
| 1.40.0-r0-20261023 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261023 | 2026-10-23 |
| 1.40.0-r0-20261023-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261023-dev | 2026-10-23 |
| 1.40.0-r0-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-dev | 2026-10-23 |
| 1.40.0-r0-20261022 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261022 | 2026-10-22 |
| 1.40.0-r0-20261022-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261022-dev | 2026-10-22 |
| 1.40.0-r0-20261021 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261021 | 2026-10-21 |
| 1.40.0-r0-20261021-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261021-dev | 2026-10-21 |
| 1.40.0-r0-20261020 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261020 | 2026-10-20 |
| 1.40.0-r0-20261020-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261020-dev | 2026-10-20 |
| 1.40.0-r0-20261019 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261019 | 2026-10-19 |
| 1.40.0-r0-20261019-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261019-dev | 2026-10-19 |
| 1.40.0-r0-20261018 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261018 | 2026-10-18 |
| 1.40.0-r0-20261018-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261018-dev | 2026-10-18 |
| 1.40.0-r0-20261016 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261016 | 2026-10-16 |
| 1.40.0-r0-20261017 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261017 | 2026-10-16 |
| 1.40.0-r0-20261016-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261016-dev | 2026-10-16 |
| 1.40.0-r0-20261017-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261017-dev | 2026-10-16 |
| 1.40.0-r0-20261015 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261015 | 2026-10-15 |
| 1.40.0-r0-20261015-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261015-dev | 2026-10-15 |
| 1.40.0-r0-20261014 | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261014 | 2026-10-14 |
| 1.40.0-r0-20261014-dev | ghcr.io/rtvkiz/minimal-envoy:1.40.0-r0-20261014-dev | 2026-10-14 |
| 1.39 | ghcr.io/rtvkiz/minimal-envoy:1.39 | 2026-10-14 |
| 1.39.4-r0 | ghcr.io/rtvkiz/minimal-envoy:1.39.4-r0 | 2026-10-14 |
| 1.39.4-r0-20261014 | ghcr.io/rtvkiz/minimal-envoy:1.39.4-r0-20261014 | 2026-10-14 |
| 1.39-dev | ghcr.io/rtvkiz/minimal-envoy:1.39-dev | 2026-10-14 |
| 1.39.4-r0-20261014-dev | ghcr.io/rtvkiz/minimal-envoy:1.39.4-r0-20261014-dev | 2026-10-14 |
| 1.39.4-r0-dev | ghcr.io/rtvkiz/minimal-envoy:1.39.4-r0-dev | 2026-10-14 |
The resolved SBOM isn't available for this build yet — showing the packages requested in the apko build recipe (without resolved versions). The full SBOM appears after the next scheduled build.
Clean No known vulnerabilities in the latest scan.
Everything is verifiable without an account. Copy and run:
Build provenance (SLSA v1.0, Build L2)
gh attestation verify oci://ghcr.io/rtvkiz/minimal-envoy:latest --owner rtvkizCosign signature
cosign verify \
--certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
--certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
ghcr.io/rtvkiz/minimal-envoy:latestSBOM attestation (SPDX)
cosign verify-attestation --type spdxjson \
--certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
--certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
ghcr.io/rtvkiz/minimal-envoy:latest \
| jq -r '.payload | @base64d | fromjson | .predicate'Signatures are logged in the public Rekor transparency log.
More Web Servers & Proxies images
Weighing this against another provider? The comparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read the migration guide for what actually breaks when you switch.