erlang Languages & Runtimes

Erlang/OTP runtime for concurrent, fault-tolerant applications, built from source.

Size 90 MB Arch x86_64, aarch64 User nonroot (65532) Updated today Upstream www.erlang.org

Pull this image

docker pull ghcr.io/rtvkiz/minimal-erlang:latest

Details

Repository: ghcr.io/rtvkiz/minimal-erlang
Size (compressed): 90 MB
Built: 2026-09-29T00:41:43Z (today)
Architectures: x86_64, aarch64
Primary package: erlang

Entrypoint

/usr/bin/erl

User

nonroot (65532)

Working dir

/app

Architectures

x86_64, aarch64

Environment

Labels

org.opencontainers.image.title	minimal-erlang
org.opencontainers.image.description	Hardened Erlang/OTP runtime built from source with CVE patches on every rebuild
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/erlang
org.opencontainers.image.licenses	Apache-2.0

Tag	Pull	Published
29	ghcr.io/rtvkiz/minimal-erlang:29	2026-09-29
29.1	ghcr.io/rtvkiz/minimal-erlang:29.1	2026-09-29
29.1.1-r0	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0	2026-09-29
29.1.1-r0-20260929	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260929	2026-09-29
latest	ghcr.io/rtvkiz/minimal-erlang:latest	2026-09-29
29-dev	ghcr.io/rtvkiz/minimal-erlang:29-dev	2026-09-29
29.1-dev	ghcr.io/rtvkiz/minimal-erlang:29.1-dev	2026-09-29
29.1.1-r0-20260929-dev	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260929-dev	2026-09-29
29.1.1-r0-dev	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-dev	2026-09-29
latest-dev	ghcr.io/rtvkiz/minimal-erlang:latest-dev	2026-09-29
29.1.1-r0-20260928	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260928	2026-09-28
29.1.1-r0-20260928-dev	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260928-dev	2026-09-28
29.1.1-r0-20260927	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260927	2026-09-27
29.1.1-r0-20260927-dev	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260927-dev	2026-09-27
29.1.1-r0-20260926	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260926	2026-09-26
29.1.1-r0-20260926-dev	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260926-dev	2026-09-26
29.1.1-r0-20260925	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260925	2026-09-25
29.1.1-r0-20260925-dev	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260925-dev	2026-09-25
29.1.1-r0-20260924	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260924	2026-09-24
29.1.1-r0-20260924-dev	ghcr.io/rtvkiz/minimal-erlang:29.1.1-r0-20260924-dev	2026-09-24

90 packages in the image, resolved from the SPDX SBOM.

Package	Version	License
alpine/ca-certificates	20260909	MPL-2.0 AND MIT
brotli	v1.2.0	MIT
brotli.yaml	9db3aeed30b6359289528ef564a4909f78faeac9	Apache-2.0
busybox	1.38.0-r2	GPL-2.0-only
busybox	1.38.0-r2	GPL-2.0-only
busybox	1.38.0-r2	—
busybox_mirror	1_38_0	GPL-2.0-only
busybox.yaml	71881f600839f8cdaced7ecf938b4efc90a09c33	Apache-2.0
ca-certificates-bundle	20260909-r1	MPL-2.0 AND MIT
ca-certificates-bundle	20260909-r1	(MPL-2.0 AND MIT)
ca-certificates-bundle	20260909-r1	—
ca-certificates.yaml	ee3eac73dda22e8dd32fa5fb3e3a1712a6e812d7	Apache-2.0
erlang	29.1.1-r0	Apache-2.0
gcc.yaml	794cf72f88e1b408eca5da0dbf5c5ed25543606d	Apache-2.0
git/glibc	b4f51887c48ac82acfdb13f96d9eab5d120cb2b7	LGPL-2.1-or-later
glibc-2.44	2.44-r7	LGPL-2.1-or-later
glibc-2.44	2.44-r7	LGPL-2.1-or-later
glibc-2.44	2.44-r7	—
glibc-2.44-locale-posix	2.44-r7	LGPL-2.1-or-later
glibc-2.44-locale-posix	2.44-r7	LGPL-2.1-or-later
glibc-2.44-locale-posix	2.44-r7	—
glibc-2.44.yaml	2f4fbb70b55156f2d4cabff471b50dab0e75aa89	Apache-2.0
gnutools/gcc	releases/gcc-16.2.0	GPL-3.0-or-later WITH GCC-exception-3.1
images/erlang/melange.yaml	1bce6e63ea891bcced1fda6bdc6813ced3474c4e	—
ld-linux-2.44	2.44-r7	LGPL-2.1-or-later
ld-linux-2.44	2.44-r7	LGPL-2.1-or-later
ld-linux-2.44	2.44-r7	—
libbrotlicommon1	1.2.0-r5	MIT
libbrotlicommon1	1.2.0-r5	MIT
libbrotlicommon1	1.2.0-r5	—
libbrotlidec1	1.2.0-r5	MIT
libbrotlidec1	1.2.0-r5	MIT
libbrotlidec1	1.2.0-r5	—
libbrotlienc1	1.2.0-r5	MIT
libbrotlienc1	1.2.0-r5	MIT
libbrotlienc1	1.2.0-r5	—
libcrypt1-2.44	2.44-r7	LGPL-2.1-or-later
libcrypt1-2.44	2.44-r7	LGPL-2.1-or-later
libcrypt1-2.44	2.44-r7	—
libcrypto3	3.6.4-r8	Apache-2.0
libcrypto3	3.6.4-r8	Apache-2.0
libcrypto3	3.6.4-r8	—
libgcc	16.2.0-r1	GPL-3.0-or-later WITH GCC-exception-3.1
libgcc	16.2.0-r1	(GPL-3.0-or-later WITH GCC-exception-3.1)
libgcc	16.2.0-r1	—
libssl3	3.6.4-r8	Apache-2.0
libssl3	3.6.4-r8	Apache-2.0
libssl3	3.6.4-r8	—
libstdc++	16.2.0-r1	GPL-3.0-or-later WITH GCC-exception-3.1
libstdc++	16.2.0-r1	(GPL-3.0-or-later WITH GCC-exception-3.1)
libstdc++	16.2.0-r1	—
libxcrypt	4.5.2-r5	GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt	v4.5.2	GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt	4.5.2-r5	(GPL-2.0-or-later AND LGPL-2.1-or-later)
libxcrypt	4.5.2-r5	—
libxcrypt.yaml	e199a2ea58e2f64dce226ac5edb148fa8ff72664	Apache-2.0
ncurses	6.6.20260926-r0	MIT
ncurses	6.6.20260926-r0	MIT
ncurses	6.6.20260926-r0	—
ncurses-snapshots	v6_6_20260926	MIT
ncurses-terminfo-base	6.6.20260926-r0	MIT
ncurses-terminfo-base	6.6.20260926-r0	MIT
ncurses-terminfo-base	6.6.20260926-r0	—
ncurses.yaml	49af4fd909fca8f288f9ca88f700cbb6bd987f33	Apache-2.0
openssl	openssl-4.0.2	Apache-2.0
openssl	openssl-3.6.4	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	—
openssl-4.0-libssl	4.0.2-r2	Apache-2.0
openssl-4.0-libssl	4.0.2-r2	Apache-2.0
openssl-4.0-libssl	4.0.2-r2	—
openssl-4.0.yaml	b8f04118437fbbf25bbaad575ccb9f2ed62b8503	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	—
openssl-provider-legacy-allowed.yaml	b8f04118437fbbf25bbaad575ccb9f2ed62b8503	Apache-2.0
openssl.yaml	be56cfaac075e77bffb92439e0438bb31a21a2c7	Apache-2.0
sha256:be9280faa4b3a5e893e4a73881c40013ddade58f671da3bb3d6401f2bbb9ea41	20230201	—
sha256:f4665aaef0b5e6291c9dd391c117e9f36559c60376baea70e8a81935f19afaa9	sha256:f4665aaef0b5e6291c9dd391c117e9f36559c60376baea70e8a81935f19afaa9	—
wolfi	20230201	—
wolfi-baselayout	20230201-r30	MIT
wolfi-baselayout	20230201-r30	MIT
wolfi-baselayout	20230201-r30	—
wolfi-baselayout.yaml	a4472f6292a5e48d6d611bf24c6e119b1a483e66	Apache-2.0
zlib	1.3.2.1_rc20260601-r0	MPL-2.0 AND MIT
zlib	e3dc0a85b7032e98380dec011bc8f2c2ee0d8fca	MPL-2.0 AND MIT
zlib	1.3.2.1_rc20260601-r0	(MPL-2.0 AND MIT)
zlib	1.3.2.1_rc20260601-r0	—
zlib.yaml	f2ad881d0053f3f3b6b639e041b171fc0e5b7244	Apache-2.0

4 medium 0 fixable

CVE	Severity	Package	Installed	Fixed in
CVE-2026-77117	Medium	glibc-2.44	2.44-r7	—
CVE-2026-80489	Medium	glibc-2.44	2.44-r7	—
CVE-2026-8674	Medium	glibc-2.44	2.44-r7	—
CVE-2026-89092	Medium	glibc-2.44	2.44-r7	—

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-erlang:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-erlang:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-erlang:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Languages & Runtimes images

Weighing this against another provider? The comparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read the migration guide for what actually breaks when you switch.

org.opencontainers.image.title	minimal-erlang-dev
org.opencontainers.image.description	Dev variant of minimal-erlang: same OTP + shell, C toolchain and rebar3. Not for production.
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/erlang
org.opencontainers.image.licenses	Apache-2.0
dev.minimal.variant	dev