minimal
GitHub
  1. Images
  2. Web Servers & Proxies
  3. kong

kong

Kong API Gateway built on Nginx and OpenResty, compiled from source against maintained OpenSSL. DB-less by default, signed, SBOM-attested, rebuilt daily.

Vulnerabilities
Compressed size
81 MB
Architectures
amd64, arm64
Default user
kong (65532)
Last built
today
Upstream
konghq.com

Pull this image

docker pull ghcr.io/rtvkiz/minimal-kong:latest
Repository
ghcr.io/rtvkiz/minimal-kong
Digest
sha256:cddad54bb71cb92acfe93fb70f2ac0623ec40b56a4f91de5fe441a237b938756
Built at
2026-11-12T08:19:47Z
Primary package
kong
Entrypoint
/usr/local/bin/kong start --prefix /usr/local/kong
User
kong (65532)
Working dir
/usr/local/kong
Architectures
x86_64, aarch64
Environment
PATH=/usr/local/bin:/usr/bin:/binLD_LIBRARY_PATH=/usr/local/openresty/luajit/libKONG_PREFIX=/usr/local/kongKONG_DATABASE=offKONG_NGINX_DAEMON=off
Labels
org.opencontainers.image.titleminimal-kong
org.opencontainers.image.descriptionHardened shell-less Kong API Gateway built from source via melange with CVE patches on every rebuild
org.opencontainers.image.urlhttps://github.com/rtvkiz/minimal
org.opencontainers.image.sourcehttps://github.com/rtvkiz/minimal/tree/main/images/kong
org.opencontainers.image.licensesApache-2.0
TagPullPublished
3 ghcr.io/rtvkiz/minimal-kong:3 2026-11-12
3.9 ghcr.io/rtvkiz/minimal-kong:3.9 2026-11-12
3.9.4-r0 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0 2026-11-12
3.9.4-r0-20261112 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261112 2026-11-12
latest ghcr.io/rtvkiz/minimal-kong:latest 2026-11-12
3-dev ghcr.io/rtvkiz/minimal-kong:3-dev 2026-11-12
3.9-dev ghcr.io/rtvkiz/minimal-kong:3.9-dev 2026-11-12
3.9.4-r0-20261112-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261112-dev 2026-11-12
3.9.4-r0-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-dev 2026-11-12
latest-dev ghcr.io/rtvkiz/minimal-kong:latest-dev 2026-11-12
3.9.4-r0-20261111 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261111 2026-11-11
3.9.4-r0-20261111-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261111-dev 2026-11-11
3.9.4-r0-20261110 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261110 2026-11-10
3.9.4-r0-20261110-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261110-dev 2026-11-10
3.9.4-r0-20261108 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261108 2026-11-08
3.9.4-r0-20261108-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261108-dev 2026-11-08
3.9.4-r0-20261107 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261107 2026-11-07
3.9.4-r0-20261107-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261107-dev 2026-11-07
3.9.4-r0-20261105 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261105 2026-11-05
3.9.4-r0-20261105-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261105-dev 2026-11-05
3.9.4-r0-20261104 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261104 2026-11-04
3.9.4-r0-20261104-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261104-dev 2026-11-04
3.9.4-r0-20261031 ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261031 2026-10-31
3.9.4-r0-20261031-dev ghcr.io/rtvkiz/minimal-kong:3.9.4-r0-20261031-dev 2026-10-31
3.9.2-r1 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1 2026-10-31
3.9.2-r1-20261031 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261031 2026-10-31
3.9.2-r1-20261031-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261031-dev 2026-10-31
3.9.2-r1-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-dev 2026-10-31
3.9.2-r1-20261030 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261030 2026-10-30
3.9.2-r1-20261030-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261030-dev 2026-10-30
3.9.2-r1-20261029 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261029 2026-10-29
3.9.2-r1-20261029-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261029-dev 2026-10-29
3.9.2-r1-20261028 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261028 2026-10-28
3.9.2-r1-20261028-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261028-dev 2026-10-28
3.9.2-r1-20261027 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261027 2026-10-27
3.9.2-r1-20261027-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261027-dev 2026-10-27
3.9.2-r1-20261026 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261026 2026-10-26
3.9.2-r1-20261026-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261026-dev 2026-10-26
3.9.2-r1-20261025 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261025 2026-10-25
3.9.2-r1-20261025-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261025-dev 2026-10-25
3.9.2-r1-20261024-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261024-dev 2026-10-24
3.9.2-r1-20261024 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261024 2026-10-24
3.9.2-r1-20261023 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261023 2026-10-23
3.9.2-r1-20261023-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261023-dev 2026-10-23
3.9.2-r1-20261022 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261022 2026-10-22
3.9.2-r1-20261022-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261022-dev 2026-10-22
3.9.2-r1-20261021 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261021 2026-10-21
3.9.2-r1-20261021-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261021-dev 2026-10-21
3.9.2-r1-20261020 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261020 2026-10-20
3.9.2-r1-20261020-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261020-dev 2026-10-20
3.9.2-r1-20261019 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261019 2026-10-19
3.9.2-r1-20261019-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261019-dev 2026-10-19
3.9.2-r1-20261018-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261018-dev 2026-10-18
3.9.2-r1-20261018 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261018 2026-10-18
3.9.2-r1-20261016 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261016 2026-10-16
3.9.2-r1-20261017 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261017 2026-10-16
3.9.2-r1-20261016-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261016-dev 2026-10-16
3.9.2-r1-20261017-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261017-dev 2026-10-16
3.9.2-r1-20261015 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261015 2026-10-15
3.9.2-r1-20261015-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261015-dev 2026-10-15
3.9.2-r1-20261014 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261014 2026-10-14
3.9.2-r1-20261014-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261014-dev 2026-10-14
3.9.2-r1-20261013 ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261013 2026-10-13
3.9.2-r1-20261013-dev ghcr.io/rtvkiz/minimal-kong:3.9.2-r1-20261013-dev 2026-10-13

128 packages in the image, resolved from the SPDX SBOM.

PackageVersionLicense
acl.yaml0d1cb8462683e2c06d7591b8b4ad4d1f2797a0f7Apache-2.0
alpine/ca-certificates20261020MPL-2.0 AND MIT
attr.yamlb9898dbb7125f3678bc8c6cd9e7a43d9d9d2c518Apache-2.0
brotliv1.2.1MIT
brotli.yamlf5ef816d1cb2bd0e165a402c4e8a4c4622464bf3Apache-2.0
busybox1.38.0-r3GPL-2.0-only
busybox1.38.0-r3GPL-2.0-only
busybox1.38.0-r3—
busybox_mirror1_38_0GPL-2.0-only
busybox.yaml59d45eb49286129d8d21b2469befa3b55be4719bApache-2.0
bzip2.yaml6ea997c2746016cbc0225ce27cb992c09feefd2aApache-2.0
ca-certificates-bundle20261020-r0MPL-2.0 AND MIT
ca-certificates-bundle20261020-r0(MPL-2.0 AND MIT)
ca-certificates-bundle20261020-r0—
ca-certificates.yaml8061afafa65af5a9026707a8880e14120dd6f4a0Apache-2.0
coreutils9.12-r7GPL-3.0-or-later
coreutils9.12-r7GPL-3.0-or-later
coreutils9.12-r7—
coreutils.yamle70a42aafaae35cfe4bfb1ca7f5d064d96318db4Apache-2.0
gcc.yaml4d188060cbd00821a95f1ef60605da4817e781bbApache-2.0
git/aclv2.4.0LGPL-2.1-or-later AND GPL-2.0-or-later
git/attrv2.6.0GPL-2.0-or-later
git/bzip2bzip2-1.0.8bzip2-1.0.6
git/coreutilsv9.12GPL-3.0-or-later
glibc-2.442.44-r16LGPL-2.1-or-later
glibc-2.442.44-r16LGPL-2.1-or-later
glibc-2.442.44-r16—
glibc-2.44-locale-posix2.44-r16LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r16LGPL-2.1-or-later
glibc-2.44-locale-posix2.44-r16—
glibc-2.44.yaml69c2b75e0711c38be3c5881e3a141667ccf54341Apache-2.0
gnutools/gccreleases/gcc-16.2.0GPL-3.0-or-later WITH GCC-exception-3.1
gnutools/glibc47e2b570410fab606de29f550534a721184852c3LGPL-2.1-or-later
images/kong/melange.yaml862101ee7af52b6dfb7db319fbf7c11793a3d433—
kong3.9.4-r0Apache-2.0
ld-linux-2.442.44-r16LGPL-2.1-or-later
ld-linux-2.442.44-r16LGPL-2.1-or-later
ld-linux-2.442.44-r16—
libacl12.4.0-r5LGPL-2.1-or-later AND GPL-2.0-or-later
libacl12.4.0-r5(LGPL-2.1-or-later AND GPL-2.0-or-later)
libacl12.4.0-r5—
libattr12.6.0-r6GPL-2.0-or-later
libattr12.6.0-r6GPL-2.0-or-later
libattr12.6.0-r6—
libbrotlicommon11.2.1-r3MIT
libbrotlicommon11.2.1-r3MIT
libbrotlicommon11.2.1-r3—
libbrotlidec11.2.1-r3MIT
libbrotlidec11.2.1-r3MIT
libbrotlidec11.2.1-r3—
libbrotlienc11.2.1-r3MIT
libbrotlienc11.2.1-r3MIT
libbrotlienc11.2.1-r3—
libbz2-11.0.8-r31bzip2-1.0.6
libbz2-11.0.8-r31bzip2-1.0.6
libbz2-11.0.8-r31—
libcrypt1-2.442.44-r16LGPL-2.1-or-later
libcrypt1-2.442.44-r16LGPL-2.1-or-later
libcrypt1-2.442.44-r16—
libgcc16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libgcc16.2.0-r3(GPL-3.0-or-later WITH GCC-exception-3.1)
libgcc16.2.0-r3—
libpcre2-8-010.49-r3BSD-3-Clause
libpcre2-8-010.49-r3BSD-3-Clause
libpcre2-8-010.49-r3—
libselinux3.11-r2libselinux-1.0
libselinux3.11-r2libselinux-1.0
libselinux3.11-r2—
libselinux.yaml7c655233085e1d8dec7fac1996f808f33b0e96cbApache-2.0
libsepol3.11-r3LGPL-2.1
libsepol3.11-r3LGPL-2.1-only
libsepol3.11-r3—
libsepol.yaml203e65dd274965582cb0226c6aa7ca368c2e684eApache-2.0
libstdc++16.2.0-r3GPL-3.0-or-later WITH GCC-exception-3.1
libstdc++16.2.0-r3(GPL-3.0-or-later WITH GCC-exception-3.1)
libstdc++16.2.0-r3—
libxcrypt4.5.2-r8GPL-2.0-or-later AND LGPL-2.1-or-later
libxcryptv4.5.2GPL-2.0-or-later AND LGPL-2.1-or-later
libxcrypt4.5.2-r8(GPL-2.0-or-later AND LGPL-2.1-or-later)
libxcrypt4.5.2-r8—
libxcrypt.yamlb9898dbb7125f3678bc8c6cd9e7a43d9d9d2c518Apache-2.0
libyaml0.2.5MIT
opensslopenssl-4.1.0Apache-2.0
opensslopenssl-4.0.3Apache-2.0
opensslopenssl-3.6.5Apache-2.0
openssl-3.6-libcrypto3.6.5-r6Apache-2.0
openssl-3.6-libcrypto3.6.5-r6Apache-2.0
openssl-3.6-libcrypto3.6.5-r6—
openssl-3.6-libssl3.6.5-r6Apache-2.0
openssl-3.6-libssl3.6.5-r6Apache-2.0
openssl-3.6-libssl3.6.5-r6—
openssl-4.0-libcrypto4.0.3-r8Apache-2.0
openssl-4.0-libcrypto4.0.3-r8Apache-2.0
openssl-4.0-libcrypto4.0.3-r8—
openssl-4.0-libssl4.0.3-r8Apache-2.0
openssl-4.0-libssl4.0.3-r8Apache-2.0
openssl-4.0-libssl4.0.3-r8—
openssl-4.0.yaml53fb2f6751f832fa61ddba06cb8a40dbba5f409fApache-2.0
openssl-provider-legacy-allowed4.1.0-r0Apache-2.0
openssl-provider-legacy-allowed4.1.0-r0Apache-2.0
openssl-provider-legacy-allowed4.1.0-r0—
openssl-provider-legacy-allowed.yamlaeae4801330be6fd269d5ed5640dc37b58ccab09Apache-2.0
openssl.yaml106006908276f73e5d13ceca9bc7038ea2d46446Apache-2.0
pcre2pcre2-10.49BSD-3-Clause
pcre2.yaml5aeb575ed7ca64fb21dfda042e170d08f1654bbcApache-2.0
perl5.44.0-r5Artistic-1.0-Perl OR GPL-1.0-or-later
perl5.44.0-r5(Artistic-1.0-Perl OR GPL-1.0-or-later)
perl5.44.0-r5—
perl.yaml8d11109f58473390f340b1f9ecc177b00a9e4e78Apache-2.0
perl5v5.44.0Artistic-1.0-Perl OR GPL-1.0-or-later
selinuxlibsepol-3.11LGPL-2.1
selinuxlibselinux-3.11libselinux-1.0
sha256:27629d06930d3079ab613d28323e6eec499e64a08e88dd3dfb7d8107706a125b20230201—
sha256:ae979b96848424b97a78b74da50fae4d149bf99f9b96957e60b7f8507a221e39sha256:ae979b96848424b97a78b74da50fae4d149bf99f9b96957e60b7f8507a221e39—
wolfi20230201—
wolfi-baselayout20230201-r31MIT
wolfi-baselayout20230201-r31MIT
wolfi-baselayout20230201-r31—
wolfi-baselayout.yamled415005c84750f03c4a9252137813734a224ae7Apache-2.0
yaml0.2.5-r12MIT
yaml0.2.5-r12MIT
yaml0.2.5-r12—
yaml.yamla47eef19c8de84e8b2d843ace686da335a870468Apache-2.0
zlib1.3.2.1_rc20260921-r2MPL-2.0 AND MIT
zlib767c4c947852e143f582c85f14cf573411df1b35MPL-2.0 AND MIT
zlib1.3.2.1_rc20260921-r2(MPL-2.0 AND MIT)
zlib1.3.2.1_rc20260921-r2—
zlib.yaml5aeb575ed7ca64fb21dfda042e170d08f1654bbcApache-2.0
1 medium 0 fixable 1 need review
CVESeverityPackageInstalledFixed in
CVE-2026-15534 Medium perl 5.44.0-r5 —

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-kong:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-kong:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-kong:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Web Servers & Proxies images

caddyenvoyhaproxyhttpdnginxoauth2-proxytomcattraefik

Weighing this against another provider? The comparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read the migration guide for what actually breaks when you switch.