sealed-secretsKubernetes, CI & IaC

Shell-less Sealed Secrets controller, built from source via melange.

Arch x86_64, aarch64User nonroot (65532)Upstream github.com/bitnami/sealed-secrets

Pull this image

docker pull ghcr.io/rtvkiz/minimal-sealed-secrets:latest

Details

Repository: ghcr.io/rtvkiz/minimal-sealed-secrets
Architectures: x86_64, aarch64
Primary package: sealed-secrets

Some data was unavailable for this build: partial.

Entrypoint

/usr/bin/controller

User

nonroot (65532)

Working dir

/tmp

Architectures

x86_64, aarch64

Environment

Labels

org.opencontainers.image.title	minimal-sealed-secrets
org.opencontainers.image.description	Hardened shell-less Sealed Secrets controller built from source via melange with CVE patches on every rebuild
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/sealed-secrets
org.opencontainers.image.licenses	Apache-2.0

Tag	Pull	Published
0.41	ghcr.io/rtvkiz/minimal-sealed-secrets:0.41	2026-10-29
0.41.2-r0	ghcr.io/rtvkiz/minimal-sealed-secrets:0.41.2-r0	2026-10-29
0.41.2-r0-20261029	ghcr.io/rtvkiz/minimal-sealed-secrets:0.41.2-r0-20261029	2026-10-29
latest	ghcr.io/rtvkiz/minimal-sealed-secrets:latest	2026-10-29
0.41-dev	ghcr.io/rtvkiz/minimal-sealed-secrets:0.41-dev	2026-10-29
0.41.2-r0-20261029-dev	ghcr.io/rtvkiz/minimal-sealed-secrets:0.41.2-r0-20261029-dev	2026-10-29
0.41.2-r0-dev	ghcr.io/rtvkiz/minimal-sealed-secrets:0.41.2-r0-dev	2026-10-29
latest-dev	ghcr.io/rtvkiz/minimal-sealed-secrets:latest-dev	2026-10-29
0.41.2-r0-20261028	ghcr.io/rtvkiz/minimal-sealed-secrets:0.41.2-r0-20261028	2026-10-28
0.41.2-r0-20261028-dev	ghcr.io/rtvkiz/minimal-sealed-secrets:0.41.2-r0-20261028-dev	2026-10-28

The resolved SBOM isn't available for this build yet — showing the packages requested in the apko build recipe (without resolved versions). The full SBOM appears after the next scheduled build.

No scan data for this build. Advisories appear after the next scheduled CVE scan.

Everything is verifiable without an account. Copy and run:

Build provenance (SLSA v1.0, Build L2)

gh attestation verify oci://ghcr.io/rtvkiz/minimal-sealed-secrets:latest --owner rtvkiz

Cosign signature

cosign verify \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-sealed-secrets:latest

SBOM attestation (SPDX)

cosign verify-attestation --type spdxjson \
  --certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
  --certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
  ghcr.io/rtvkiz/minimal-sealed-secrets:latest \
  | jq -r '.payload | @base64d | fromjson | .predicate'

Signatures are logged in the public Rekor transparency log.

More Kubernetes, CI & IaC images

Weighing this against another provider? Thecomparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read themigration guide for what actually breaks when you switch.

org.opencontainers.image.title	minimal-sealed-secrets-dev
org.opencontainers.image.description	Dev variant of minimal-sealed-secrets: same binary + shell + debugging tools. Not for production.
org.opencontainers.image.url	https://github.com/rtvkiz/minimal
org.opencontainers.image.source	https://github.com/rtvkiz/minimal/tree/main/images/sealed-secrets
org.opencontainers.image.licenses	Apache-2.0
dev.minimal.variant	dev