trust-managerKubernetes, CI & IaC
Shell-less cert-manager trust-manager, built from source via melange.
Pull this image
docker pull ghcr.io/rtvkiz/minimal-trust-manager:latestdocker pull ghcr.io/rtvkiz/minimal-trust-manager:latest-devThe -dev variant adds a shell, package manager and build toolchain. For CI and debugging — not production.
Details
- Repository
- ghcr.io/rtvkiz/minimal-trust-manager
- Architectures
- x86_64, aarch64
- Primary package
- trust-manager
Some data was unavailable for this build: partial.
- Entrypoint
- /usr/bin/trust-manager
- User
- nonroot (65532)
- Working dir
- /tmp
- Architectures
- x86_64, aarch64
- Environment
- Labels
org.opencontainers.image.title minimal-trust-manager org.opencontainers.image.description Hardened shell-less trust-manager built from source via melange with CVE patches on every rebuild org.opencontainers.image.url https://github.com/rtvkiz/minimal org.opencontainers.image.source https://github.com/rtvkiz/minimal/tree/main/images/trust-manager org.opencontainers.image.licenses Apache-2.0
- Entrypoint
- /usr/bin/trust-manager
- User
- nonroot (65532)
- Working dir
- /tmp
- Architectures
- x86_64, aarch64
- Environment
- Labels
org.opencontainers.image.title minimal-trust-manager-dev org.opencontainers.image.description Dev variant of minimal-trust-manager: same binary + shell + debugging tools. Not for production. org.opencontainers.image.url https://github.com/rtvkiz/minimal org.opencontainers.image.source https://github.com/rtvkiz/minimal/tree/main/images/trust-manager org.opencontainers.image.licenses Apache-2.0 dev.minimal.variant dev
| Tag | Pull | Published |
|---|---|---|
| 0.26 | ghcr.io/rtvkiz/minimal-trust-manager:0.26 | 2026-10-29 |
| 0.26.0-r0 | ghcr.io/rtvkiz/minimal-trust-manager:0.26.0-r0 | 2026-10-29 |
| 0.26.0-r0-20261029 | ghcr.io/rtvkiz/minimal-trust-manager:0.26.0-r0-20261029 | 2026-10-29 |
| latest | ghcr.io/rtvkiz/minimal-trust-manager:latest | 2026-10-29 |
| 0.26-dev | ghcr.io/rtvkiz/minimal-trust-manager:0.26-dev | 2026-10-29 |
| 0.26.0-r0-20261029-dev | ghcr.io/rtvkiz/minimal-trust-manager:0.26.0-r0-20261029-dev | 2026-10-29 |
| 0.26.0-r0-dev | ghcr.io/rtvkiz/minimal-trust-manager:0.26.0-r0-dev | 2026-10-29 |
| latest-dev | ghcr.io/rtvkiz/minimal-trust-manager:latest-dev | 2026-10-29 |
| 0.26.0-r0-20261028 | ghcr.io/rtvkiz/minimal-trust-manager:0.26.0-r0-20261028 | 2026-10-28 |
| 0.26.0-r0-20261028-dev | ghcr.io/rtvkiz/minimal-trust-manager:0.26.0-r0-20261028-dev | 2026-10-28 |
The resolved SBOM isn't available for this build yet — showing the packages requested in the apko build recipe (without resolved versions). The full SBOM appears after the next scheduled build.
No scan data for this build. Advisories appear after the next scheduled CVE scan.
Everything is verifiable without an account. Copy and run:
Build provenance (SLSA v1.0, Build L2)
gh attestation verify oci://ghcr.io/rtvkiz/minimal-trust-manager:latest --owner rtvkizCosign signature
cosign verify \
--certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
--certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
ghcr.io/rtvkiz/minimal-trust-manager:latestSBOM attestation (SPDX)
cosign verify-attestation --type spdxjson \
--certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
--certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
ghcr.io/rtvkiz/minimal-trust-manager:latest \
| jq -r '.payload | @base64d | fromjson | .predicate'Signatures are logged in the public Rekor transparency log.
More Kubernetes, CI & IaC images
Weighing this against another provider? Thecomparison pages publish head-to-head scan data with the raw dataset, including the images where Minimal comes off worse — or read themigration guide for what actually breaks when you switch.