kube-rbac-proxyKubernetes, CI & IaC

Shell-less kube-rbac-proxy auth sidecar, built from source via melange.

Arch x86_64, aarch64User nonroot (65532)Upstream github.com/kube-rbac-proxy/kube-rbac-proxy

Pull this image

docker pull ghcr.io/rtvkiz/minimal-kube-rbac-proxy:latest

Details

Repository: ghcr.io/rtvkiz/minimal-kube-rbac-proxy
Architectures: x86_64, aarch64
Primary package: kube-rbac-proxy

Some data was unavailable for this build: partial.

Entrypoint

/usr/bin/kube-rbac-proxy

User

nonroot (65532)

Working dir

/tmp

Architectures

x86_64, aarch64

Environment

Labels

org.opencontainers.image.title	minimal-kube-rbac-proxy
org.opencontainers.image.description	Hardened shell-less kube-rbac-proxy built from source via melange with CVE patches on every rebuild
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/kube-rbac-proxy
org.opencontainers.image.licenses	Apache-2.0

Tag	Pull	Published
0.23	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:0.23	2026-10-29
0.23.1-r0	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:0.23.1-r0	2026-10-29
0.23.1-r0-20261029	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:0.23.1-r0-20261029	2026-10-29
latest	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:latest	2026-10-29
0.23-dev	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:0.23-dev	2026-10-29
0.23.1-r0-20261029-dev	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:0.23.1-r0-20261029-dev	2026-10-29
0.23.1-r0-dev	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:0.23.1-r0-dev	2026-10-29
latest-dev	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:latest-dev	2026-10-29
0.23.1-r0-20261028	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:0.23.1-r0-20261028	2026-10-28
0.23.1-r0-20261028-dev	ghcr.io/rtvkiz/minimal-kube-rbac-proxy:0.23.1-r0-20261028-dev	2026-10-28

The resolved SBOM isn't available for this build yet — showing the packages requested in the apko build recipe (without resolved versions). The full SBOM appears after the next scheduled build.

No scan data for this build. Advisories appear after the next scheduled CVE scan.

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-kube-rbac-proxy:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-kube-rbac-proxy:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-kube-rbac-proxy:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Kubernetes, CI & IaC images

Weighing this against another provider? Thecomparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read themigration guide for what actually breaks when you switch.

org.opencontainers.image.title	minimal-kube-rbac-proxy-dev
org.opencontainers.image.description	Dev variant of minimal-kube-rbac-proxy: same binary + shell + debugging tools. Not for production.
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/kube-rbac-proxy
org.opencontainers.image.licenses	Apache-2.0
dev.minimal.variant	dev