gitea Apps

Gitea git hosting built from source via melange.

Size 179 MB Arch x86_64, aarch64 User gitea (65532) Updated today Upstream gitea.io

Pull this image

docker pull ghcr.io/rtvkiz/minimal-gitea:latest

Details

Repository: ghcr.io/rtvkiz/minimal-gitea
Size (compressed): 179 MB
Built: 2026-09-29T00:30:35Z (today)
Architectures: x86_64, aarch64
Primary package: gitea

Entrypoint

/usr/bin/gitea web --config /etc/gitea/app.ini

User

gitea (65532)

Working dir

Architectures

x86_64, aarch64

Environment

Labels

org.opencontainers.image.title	minimal-gitea
org.opencontainers.image.description	Hardened Gitea git hosting image built from source via melange with daily CVE patches
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/gitea
org.opencontainers.image.licenses	MIT

org.opencontainers.image.title	minimal-gitea-dev
org.opencontainers.image.description	Dev variant of minimal-gitea: same Gitea + bash + curl/openssl/dig/jq. Not for production.
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/gitea
org.opencontainers.image.licenses	Apache-2.0
dev.minimal.variant	dev

Tag	Pull	Published
1	ghcr.io/rtvkiz/minimal-gitea:1	2026-09-29
1.27	ghcr.io/rtvkiz/minimal-gitea:1.27	2026-09-29
1.27.3-r0	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0	2026-09-29
1.27.3-r0-20260929	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260929	2026-09-29
latest	ghcr.io/rtvkiz/minimal-gitea:latest	2026-09-29
1-dev	ghcr.io/rtvkiz/minimal-gitea:1-dev	2026-09-29
1.27-dev	ghcr.io/rtvkiz/minimal-gitea:1.27-dev	2026-09-29
1.27.3-r0-20260929-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260929-dev	2026-09-29
1.27.3-r0-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-dev	2026-09-29
latest-dev	ghcr.io/rtvkiz/minimal-gitea:latest-dev	2026-09-29
1.27.3-r0-20260928	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260928	2026-09-28
1.27.3-r0-20260928-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260928-dev	2026-09-28
1.27.3-r0-20260927	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260927	2026-09-27
1.27.3-r0-20260927-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260927-dev	2026-09-27
1.27.3-r0-20260926	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260926	2026-09-26
1.27.3-r0-20260926-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260926-dev	2026-09-26
1.27.3-r0-20260925	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260925	2026-09-25
1.27.3-r0-20260925-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260925-dev	2026-09-25
1.27.3-r0-20260924	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260924	2026-09-24
1.27.3-r0-20260924-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260924-dev	2026-09-24
1.27.3-r0-20260923	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260923	2026-09-23
1.27.3-r0-20260923-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260923-dev	2026-09-23
1.27.3-r0-20260922	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260922	2026-09-22
1.27.3-r0-20260922-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260922-dev	2026-09-22
1.27.3-r0-20260921	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260921	2026-09-21
1.27.3-r0-20260921-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260921-dev	2026-09-21
1.27.3-r0-20260920	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260920	2026-09-20
1.27.3-r0-20260920-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260920-dev	2026-09-20
1.27.3-r0-20260919	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260919	2026-09-19
1.27.3-r0-20260919-dev	ghcr.io/rtvkiz/minimal-gitea:1.27.3-r0-20260919-dev	2026-09-19

210 packages in the image, resolved from the SPDX SBOM.

Package	Version	License
alpine/ca-certificates	20260909	MPL-2.0 AND MIT
brotli	v1.2.0	MIT
brotli.yaml	9db3aeed30b6359289528ef564a4909f78faeac9	Apache-2.0
busybox	1.38.0-r2	GPL-2.0-only
busybox	1.38.0-r2	GPL-2.0-only
busybox	1.38.0-r2	—
busybox_mirror	1_38_0	GPL-2.0-only
busybox.yaml	71881f600839f8cdaced7ecf938b4efc90a09c33	Apache-2.0
ca-certificates-bundle	20260909-r1	MPL-2.0 AND MIT
ca-certificates-bundle	20260909-r1	(MPL-2.0 AND MIT)
ca-certificates-bundle	20260909-r1	—
ca-certificates.yaml	ee3eac73dda22e8dd32fa5fb3e3a1712a6e812d7	Apache-2.0
curl	curl-8_22_0	MIT
curl.yaml	c5048fcb3198115fb098c0a28f813517e4a1261b	Apache-2.0
cyrus-sasl	cyrus-sasl-2.1.28	BSD-3-Clause
cyrus-sasl-heimdal-libs	2.1.28-r57	BSD-3-Clause
cyrus-sasl-heimdal-libs	2.1.28-r57	BSD-3-Clause
cyrus-sasl-heimdal-libs	2.1.28-r57	—
cyrus-sasl-heimdal.yaml	ee3eac73dda22e8dd32fa5fb3e3a1712a6e812d7	Apache-2.0
e2fsprogs	v1.47.4	GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT
e2fsprogs.yaml	b99a75e3a9c26fa0720cd2cf394093c19d279152	Apache-2.0
expat.yaml	dab6a75a661461bd0df375aac57d6c62655d076f	Apache-2.0
gcc.yaml	794cf72f88e1b408eca5da0dbf5c5ed25543606d	Apache-2.0
gdbm	1.26-r6	GPL-3.0-or-later
gdbm	1.26-r6	GPL-3.0-or-later
gdbm	1.26-r6	—
gdbm.yaml	f003022285365e5de3bee7aa44caafa602eca04b	Apache-2.0
git	2.55.0-r8	GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
git	2.55.0-r8	GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
git	2.55.0-r8	—
git.yaml	ee3eac73dda22e8dd32fa5fb3e3a1712a6e812d7	Apache-2.0
git/gdbm	v1.26	GPL-3.0-or-later
git/glibc	b4f51887c48ac82acfdb13f96d9eab5d120cb2b7	LGPL-2.1-or-later
git/libunistring	v1.4.2	GPL-2.0-or-later OR LGPL-3.0-or-later
git/readline	readline-8.3	GPL-3.0-or-later
gitea	1.27.3-r0	MIT
glibc-2.44	2.44-r7	LGPL-2.1-or-later
glibc-2.44	2.44-r7	LGPL-2.1-or-later
glibc-2.44	2.44-r7	—
glibc-2.44-locale-posix	2.44-r7	LGPL-2.1-or-later
glibc-2.44-locale-posix	2.44-r7	LGPL-2.1-or-later
glibc-2.44-locale-posix	2.44-r7	—
glibc-2.44.yaml	2f4fbb70b55156f2d4cabff471b50dab0e75aa89	Apache-2.0
gnutools/gcc	releases/gcc-16.2.0	GPL-3.0-or-later WITH GCC-exception-3.1
heimdal	heimdal-7.8.0	BSD-3-Clause
heimdal-libs	7.8.0-r52	BSD-3-Clause
heimdal-libs	7.8.0-r52	BSD-3-Clause
heimdal-libs	7.8.0-r52	—
heimdal.yaml	16b770d73d6c8d3601394aa2d9f71d15b074a8db	Apache-2.0
images/gitea/melange.yaml	1bce6e63ea891bcced1fda6bdc6813ced3474c4e	—
keyutils-libs	1.6.3-r40	GPL-2.0-or-later OR LGPL-2.0-or-later
keyutils-libs	1.6.3-r40	(GPL-2.0-or-later OR LGPL-2.0-or-later)
keyutils-libs	1.6.3-r40	—
keyutils.yaml	2e53452a8c1a05c81d7beb0148e1b8d73fd088c3	Apache-2.0
krb5	krb5-1.22.2-final	MIT
krb5-conf	1.0-r9	MIT
krb5-conf	1.0-r9	MIT
krb5-conf	1.0-r9	—
krb5-conf.yaml	bb37bc90f076f9eb2a12980e43c3f12673133835	Apache-2.0
krb5-libs	1.22.2-r4	MIT
krb5-libs	1.22.2-r4	MIT
krb5-libs	1.22.2-r4	—
krb5.yaml	9a7875e9cfcbd59186154753bceb1d973e939c32	Apache-2.0
ld-linux-2.44	2.44-r7	LGPL-2.1-or-later
ld-linux-2.44	2.44-r7	LGPL-2.1-or-later
ld-linux-2.44	2.44-r7	—
libbrotlicommon1	1.2.0-r5	MIT
libbrotlicommon1	1.2.0-r5	MIT
libbrotlicommon1	1.2.0-r5	—
libbrotlidec1	1.2.0-r5	MIT
libbrotlidec1	1.2.0-r5	MIT
libbrotlidec1	1.2.0-r5	—
libbrotlienc1	1.2.0-r5	MIT
libbrotlienc1	1.2.0-r5	MIT
libbrotlienc1	1.2.0-r5	—
libbsd	0.12.2-r8	BSD-3-Clause
libbsd	0.12.2-r8	BSD-3-Clause
libbsd	0.12.2-r8	—
libbsd.yaml	8b1ff71853f2ec84e2190f85c043ac75645ef221	Apache-2.0
libbsd/libbsd	0.12.2	BSD-3-Clause
libbsd/libmd	1.2.0	CC-PDDC
libcom_err	1.47.4-r2	GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT
libcom_err	1.47.4-r2	(GPL-2.0-or-later AND LGPL-2.0-or-later AND BSD-3-Clause AND MIT)
libcom_err	1.47.4-r2	—
libcrypt1-2.44	2.44-r7	LGPL-2.1-or-later
libcrypt1-2.44	2.44-r7	LGPL-2.1-or-later
libcrypt1-2.44	2.44-r7	—
libcrypto3	3.6.4-r8	Apache-2.0
libcrypto3	3.6.4-r8	Apache-2.0
libcrypto3	3.6.4-r8	—
libcurl-openssl4	8.22.0-r3	MIT
libcurl-openssl4	8.22.0-r3	MIT
libcurl-openssl4	8.22.0-r3	—
libexpat	R_2_8_5	MIT
libexpat1	2.8.5-r0	MIT
libexpat1	2.8.5-r0	MIT
libexpat1	2.8.5-r0	—
libgcc	16.2.0-r1	GPL-3.0-or-later WITH GCC-exception-3.1
libgcc	16.2.0-r1	(GPL-3.0-or-later WITH GCC-exception-3.1)
libgcc	16.2.0-r1	—
libidn/libidn2	v2.3.8	GPL-2.0-or-later AND LGPL-3.0-or-later
libidn2	2.3.8-r9	GPL-2.0-or-later AND LGPL-3.0-or-later
libidn2	2.3.8-r9	(GPL-2.0-or-later AND LGPL-3.0-or-later)
libidn2	2.3.8-r9	—
libidn2.yaml	515b608d6ada311d2f8d873090ee6e9ab1b0e270	Apache-2.0
libldap-2.7	2.7.1-r1	OLDAP-2.8
libldap-2.7	2.7.1-r1	OLDAP-2.8
libldap-2.7	2.7.1-r1	—
libmd	1.2.0-r3	CC-PDDC
libmd	1.2.0-r3	CC-PDDC
libmd	1.2.0-r3	—
libmd.yaml	3f36a28ed3bbcdbbf60ccb09a73c4b7a505ff57e	Apache-2.0
libnghttp2-14	1.70.0-r4	MIT
libnghttp2-14	1.70.0-r4	MIT
libnghttp2-14	1.70.0-r4	—
libpcre2-8-0	10.49-r0	BSD-3-Clause
libpcre2-8-0	10.49-r0	BSD-3-Clause
libpcre2-8-0	10.49-r0	—
libpsl	0.23.3-r1	MIT
libpsl	0.23.3	MIT
libpsl	0.23.3-r1	MIT
libpsl	0.23.3-r1	—
libpsl.yaml	f5315bacaee7e38f785cf4506595b8a03d29e5c0	Apache-2.0
libssl3	3.6.4-r8	Apache-2.0
libssl3	3.6.4-r8	Apache-2.0
libssl3	3.6.4-r8	—
libstdc++	16.2.0-r1	GPL-3.0-or-later WITH GCC-exception-3.1
libstdc++	16.2.0-r1	(GPL-3.0-or-later WITH GCC-exception-3.1)
libstdc++	16.2.0-r1	—
libunistring	1.4.2-r3	GPL-2.0-or-later OR LGPL-3.0-or-later
libunistring	1.4.2-r3	(GPL-2.0-or-later OR LGPL-3.0-or-later)
libunistring	1.4.2-r3	—
libunistring.yaml	7ef46f8f31c30c8b2ad450cc071debf618da28f5	Apache-2.0
libverto	0.3.2-r8	MIT
libverto	0.3.2	MIT
libverto	0.3.2-r8	MIT
libverto	0.3.2-r8	—
libverto.yaml	12f50f8d25640a0ca5ce3ac4cb6a2b8c472ab7a6	Apache-2.0
libxcrypt	4.5.2-r5	GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt	v4.5.2	GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt	4.5.2-r5	(GPL-2.0-or-later AND LGPL-2.1-or-later)
libxcrypt	4.5.2-r5	—
libxcrypt.yaml	e199a2ea58e2f64dce226ac5edb148fa8ff72664	Apache-2.0
ncurses	6.6.20260926-r0	MIT
ncurses	6.6.20260926-r0	MIT
ncurses	6.6.20260926-r0	—
ncurses-snapshots	v6_6_20260926	MIT
ncurses-terminfo-base	6.6.20260926-r0	MIT
ncurses-terminfo-base	6.6.20260926-r0	MIT
ncurses-terminfo-base	6.6.20260926-r0	—
ncurses.yaml	49af4fd909fca8f288f9ca88f700cbb6bd987f33	Apache-2.0
netcat-openbsd	1.238-r1	BSD-3-Clause
netcat-openbsd	1.238	—
netcat-openbsd	1.238	—
netcat-openbsd	1.238-r1	BSD-3-Clause
netcat-openbsd	1.238-r1	—
netcat-openbsd.yaml	5d0b7f5d04272f857708747aa330ab7af2dba670	Apache-2.0
nghttp2	v1.70.0	MIT
nghttp2.yaml	88d034c8a90ab9303114c4a82765cd63372ec5f3	Apache-2.0
nghttp3	1.18.0-r1	MIT
nghttp3	v1.18.0	MIT
nghttp3	1.18.0-r1	MIT
nghttp3	1.18.0-r1	—
nghttp3.yaml	0956f7ab8259acb3cad0885e4537ed6b1779d818	Apache-2.0
ngtcp2	1.25.0-r4	MIT
ngtcp2	v1.25.0	MIT
ngtcp2	1.25.0-r4	MIT
ngtcp2	1.25.0-r4	—
ngtcp2.yaml	ecc58ee4fc1a3a0734bbd164bc518a4ac0ed371c	Apache-2.0
openldap	OPENLDAP_REL_ENG_2_7_1	OLDAP-2.8
openldap-2.7.yaml	0bec60b2e47ce757adc2340f526da8e90046e0b8	Apache-2.0
openssl	openssl-4.0.2	Apache-2.0
openssl	openssl-3.6.4	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	Apache-2.0
openssl-4.0-libcrypto	4.0.2-r2	—
openssl-4.0-libssl	4.0.2-r2	Apache-2.0
openssl-4.0-libssl	4.0.2-r2	Apache-2.0
openssl-4.0-libssl	4.0.2-r2	—
openssl-4.0.yaml	b8f04118437fbbf25bbaad575ccb9f2ed62b8503	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	Apache-2.0
openssl-provider-legacy-allowed	4.0.2-r3	—
openssl-provider-legacy-allowed.yaml	b8f04118437fbbf25bbaad575ccb9f2ed62b8503	Apache-2.0
openssl.yaml	be56cfaac075e77bffb92439e0438bb31a21a2c7	Apache-2.0
pcre2	pcre2-10.49	BSD-3-Clause
pcre2.yaml	12446114fe264503593128d308520875edaca797	Apache-2.0
pub/scm/git/git	v2.55.0	GPL-2.0-or-later AND ( Artistic-1.0-Perl OR GPL-1.0-or-later )
pub/scm/linux/kernel/git/dhowells/keyutils	v1.6.3	GPL-2.0-or-later OR LGPL-2.0-or-later
readline	8.3-r3	GPL-3.0-or-later
readline	8.3-r3	GPL-3.0-or-later
readline	8.3-r3	—
readline.yaml	20a5359ac0a7a6aca23efa343f0f29c8d3ea1453	Apache-2.0
sha256:4ab283de4cc0a273d215ee6d6986aa68d2599593ccb97f283d84b78160af841c	20230201	—
sha256:c608d47607536eadbe6a9395d08541129e30fde09a996812f6a9703ee9205a4b	sha256:c608d47607536eadbe6a9395d08541129e30fde09a996812f6a9703ee9205a4b	—
sqlite	3.53.4	—
sqlite-libs	3.53.4-r2	blessing
sqlite-libs	3.53.4-r2	blessing
sqlite-libs	3.53.4-r2	—
sqlite.yaml	89df0d1a31c1a22d7d67ddf690145ffc5b9f759d	Apache-2.0
wolfi	20230201	—
wolfi-baselayout	20230201-r30	MIT
wolfi-baselayout	20230201-r30	MIT
wolfi-baselayout	20230201-r30	—
wolfi-baselayout.yaml	a4472f6292a5e48d6d611bf24c6e119b1a483e66	Apache-2.0
zlib	1.3.2.1_rc20260601-r0	MPL-2.0 AND MIT
zlib	e3dc0a85b7032e98380dec011bc8f2c2ee0d8fca	MPL-2.0 AND MIT
zlib	1.3.2.1_rc20260601-r0	(MPL-2.0 AND MIT)
zlib	1.3.2.1_rc20260601-r0	—
zlib.yaml	f2ad881d0053f3f3b6b639e041b171fc0e5b7244	Apache-2.0

4 medium 0 fixable 10 withheld

CVE	Severity	Package	Installed	Fixed in
CVE-2026-77117	Medium	glibc-2.44	2.44-r7	—
CVE-2026-80489	Medium	glibc-2.44	2.44-r7	—
CVE-2026-8674	Medium	glibc-2.44	2.44-r7	—
CVE-2026-89092	Medium	glibc-2.44	2.44-r7	—

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-gitea:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-gitea:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-gitea:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Apps images

Weighing this against another provider? The comparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read the migration guide for what actually breaks when you switch.