# ReadyStack > ReadyStack publishes free Docker images of open-source Community Edition software, each with a handbook checked against the exact image, tested seed data, a dated security grade and a public defect record, plus a Hermetic Build Kit per release that rebuilds the same image offline. ReadyStack does not charge for recipes or build kits: every release's pinned recipe and its build kit are free to any registered account. ## Products (94), as of 2026-10-30 19:49 UTC Grades are ReadyStack's own scan of each published image (a syft SBOM and grype vulnerability matches, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26): the original grade is the first recorded scan of the release, the current grade the latest daily scan. The same data as JSON: https://readystack.dev/api/products and https://readystack.dev/api/scans. ### Apache Airflow 3.3.2 - Page: https://readystack.dev/products/airflow - Image: readystack/airflow:3.3.2-CE-ubuntu24.04-r5 (https://hub.docker.com/r/readystack/airflow/tags?name=3.3.2-CE-ubuntu24.04-r5) - Pull: docker pull readystack/airflow:3.3.2-CE-ubuntu24.04-r5 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/airflow:3.3.2-CE-ubuntu24.04-r5 - Hermetic Build Kit: https://readystack.dev/products/airflow#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/airflow/recipe (public in part; every file with a free account) - Upstream source: https://github.com/apache/airflow/tree/aa19d2dbb9ed187ec01957a92848d9b005e9ba9d (commit aa19d2dbb9ed187ec01957a92848d9b005e9ba9d) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (airflow) - About: Airflow lets you programmatically author, schedule, and monitor complex data pipelines. It provides a visual interface to track workflow status and manage dependencies across your data infrastructure. - Who uses it: Data engineers and platform teams who run scheduled data pipelines, batch jobs and model training. - Why: Airflow lets them write workflows as Python code, then schedules each task in dependency order and shows runs, progress and failures in a web interface. - Use case: Every night a team pulls sales data from several systems, cleans it and loads it into a reporting database. In Airflow each step is a task in one workflow file kept in version control; the scheduler runs the steps in order, and when one fails the team sees which step broke and why. - Sources: https://github.com/apache/airflow, https://airflow.apache.org/docs/apache-airflow/stable/index.html ### Apache Kafka 4.4.0 - Page: https://readystack.dev/products/kafka - Image: readystack/kafka:4.4.0-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/kafka/tags?name=4.4.0-CE-ubuntu24.04-r2) - Pull: docker pull readystack/kafka:4.4.0-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kafka:4.4.0-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/kafka#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kafka/recipe (public in part; every file with a free account) - Upstream source: https://github.com/apache/kafka/tree/1156b2752aaa28eafc0b4c4d387e63356793268d (commit 1156b2752aaa28eafc0b4c4d387e63356793268d) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (kafka) - Who uses it: Engineering teams who move streams of events between systems in real time, for data pipelines, analytics and event-driven applications. - Why: Kafka is a distributed event streaming platform. Applications publish streams of events, Kafka stores them durably, and other applications read and process them in real time or later. - Use case: An online retailer records every order, payment and shipment as an event. Kafka stores those streams, and the warehouse system, the fraud checks and the analytics database each read them at their own pace, instead of every system calling every other system directly. - Sources: https://github.com/apache/kafka, https://kafka.apache.org/intro ### Apache Superset 6.1.0 - Page: https://readystack.dev/products/superset - Image: readystack/superset:6.1.0-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/superset/tags?name=6.1.0-CE-ubuntu24.04-r3) - Pull: docker pull readystack/superset:6.1.0-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/superset:6.1.0-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/superset#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/superset/recipe (public in part; every file with a free account) - Upstream source: https://github.com/apache/superset/tree/c83fb2bb1dcfac41ac51bcebd82471f4a7180d18 (commit c83fb2bb1dcfac41ac51bcebd82471f4a7180d18) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (superset) - About: Apache Superset enables teams to create interactive dashboards and explore data visually without writing code. It supports diverse data sources and allows users to share insights through customizable reports and embedded analytics. - Who uses it: Data teams and business users who explore data and build dashboards on top of their SQL databases. - Why: Apache Superset is an open-source data exploration and visualisation platform: a no-code chart builder, a web-based SQL editor, a light semantic layer, and support for nearly any SQL database. - Use case: A data team's warehouse holds sales and marketing data that managers want to see daily. Analysts define the shared metrics once in Superset, managers build their own charts with the no-code interface, and analysts dig deeper with the SQL editor when a number looks wrong. - Sources: https://github.com/apache/superset ### Argo CD v3.5.6 - Page: https://readystack.dev/products/argocd - Image: readystack/argocd:v3.5.6-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/argocd/tags?name=v3.5.6-CE-ubuntu24.04-r1) - Pull: docker pull readystack/argocd:v3.5.6-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/argocd:v3.5.6-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/argocd#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/argocd/recipe (public in part; every file with a free account) - Upstream source: https://github.com/argoproj/argo-cd/tree/c2b1e3017e2cec86b122172e861dcd026453ae44 (commit c2b1e3017e2cec86b122172e861dcd026453ae44) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (999) - Who uses it: Platform and DevOps teams who deploy applications to Kubernetes clusters. - Why: Argo CD treats a Git repository as the source of truth for what should run. It compares each cluster with Git, shows the differences, and syncs the cluster back to the declared state. - Use case: A team keeps the manifests for its services in Git. A change merged there is what reaches staging and production: Argo CD notices the new target state and applies it, and if someone edits a cluster by hand, the application shows as out of sync until it is brought back in line. - Sources: https://github.com/argoproj/argo-cd, https://argo-cd.readthedocs.io/en/stable/ ### authentik 2026.8.5 - Page: https://readystack.dev/products/authentik - Image: readystack/authentik:2026.8.5-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/authentik/tags?name=2026.8.5-CE-ubuntu24.04-r3) - Pull: docker pull readystack/authentik:2026.8.5-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/authentik:2026.8.5-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/authentik#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/authentik/recipe (public in part; every file with a free account) - Upstream source: https://github.com/goauthentik/authentik/tree/4ec0d19b98da3c329781894cd550da95d3033954 (commit 4ec0d19b98da3c329781894cd550da95d3033954) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (1000) - About: authentik manages user identities and access control for your applications. It handles authentication and authorization through a single interface, eliminating the need for complex infrastructure. - Who uses it: System administrators and security engineers who run single sign-on for self-hosted applications. - Why: authentik is an identity provider: people sign in once and reach every connected application over SAML, OAuth, OpenID Connect, LDAP or RADIUS, and administrators manage users and passwords in one place. - Use case: A small company runs a wiki, a Git server and a monitoring dashboard, each with its own logins. With authentik in front of them, staff sign in once, administrators manage accounts in one place, and deactivating a departing employee's account in authentik stops them signing in to any connected app. - Sources: https://github.com/goauthentik/authentik, https://docs.goauthentik.io/ ### BookStack v26.09.2 - Page: https://readystack.dev/products/bookstack - Image: readystack/bookstack:v26.09.2-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/bookstack/tags?name=v26.09.2-CE-ubuntu24.04-r3) - Pull: docker pull readystack/bookstack:v26.09.2-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/bookstack:v26.09.2-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/bookstack#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/bookstack/recipe (public in part; every file with a free account) - Upstream source: https://github.com/BookStackApp/BookStack/tree/6265d5667dd6904b7aa0d05a8c60795cf104011b (commit 6265d5667dd6904b7aa0d05a8c60795cf104011b) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (bookstack) - About: BookStack organizes your team’s documentation into a clear, hierarchical structure. This self-hosted solution requires an external database, giving you full control over your data storage and infrastructure management. - Who uses it: Teams and organisations that want a simple, self-hosted place to write and organise documentation. - Why: BookStack stores knowledge as books, chapters and pages, with a simple WYSIWYG editor and full search, so anyone with basic word-processing skills can write and find documentation. - Use case: An IT team keeps runbooks, onboarding notes and how-to guides in scattered files. In BookStack each system gets a book, each topic a chapter and each procedure a page; new staff search one place, and anyone who can use a word processor can keep a page up to date. - Sources: https://github.com/BookStackApp/BookStack, https://www.bookstackapp.com/ ### Caddy v2.11.7 - Page: https://readystack.dev/products/caddy - Image: readystack/caddy:v2.11.7-CE-ubuntu24.04-r5 (https://hub.docker.com/r/readystack/caddy/tags?name=v2.11.7-CE-ubuntu24.04-r5) - Pull: docker pull readystack/caddy:v2.11.7-CE-ubuntu24.04-r5 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/caddy:v2.11.7-CE-ubuntu24.04-r5 - Hermetic Build Kit: https://readystack.dev/products/caddy#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/caddy/recipe (public in part; every file with a free account) - Upstream source: https://github.com/caddyserver/caddy/tree/72dd0fb067f6d7826c7f79907670ba4a713bfe37 (commit 72dd0fb067f6d7826c7f79907670ba4a713bfe37) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (caddy) - About: Caddy serves as a modern web server that automatically manages HTTPS certificates for your applications. It simplifies secure traffic routing without requiring complex configuration or external dependencies. - Who uses it: Developers and system administrators who serve websites, APIs and apps and want HTTPS without handling certificates by hand. - Why: Caddy is a web server and reverse proxy with HTTPS on by default: it gets and renews certificates for public names and runs its own local certificate authority for internal names. - Use case: A small team runs several web apps on one server. A short Caddyfile puts each app behind its own domain name as a reverse proxy; Caddy obtains and renews the certificates and redirects plain HTTP to HTTPS, so nobody copies certificate files around or tracks expiry dates. - Sources: https://github.com/caddyserver/caddy, https://caddyserver.com/docs/, https://caddyserver.com/docs/automatic-https ### Canvas LMS 2026-05-20.143 - Page: https://readystack.dev/products/canvas - Image: readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/canvas/tags?name=2026-05-20.143-CE-ubuntu24.04-r2) - Pull: docker pull readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/canvas:2026-05-20.143-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/canvas#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/canvas/recipe (public in part; every file with a free account) - Upstream source: https://github.com/instructure/canvas-lms/tree/2e2b4a46d08e32667d4845f7b78e1214250345d3 (commit 2e2b4a46d08e32667d4845f7b78e1214250345d3) - Original grade: A (score 100 of 100), pushed 2026-10-30, scanned 2026-10-30 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (canvas) - About: Canvas provides a visual workspace for designing and prototyping user interfaces directly in the browser. It enables teams to collaborate on interactive designs without requiring complex development environments or specialized tools. - Who uses it: Colleges, universities and schools that run their own learning management system. - Why: Canvas LMS gives each course an online home where instructors publish content and assignments, post announcements, hold discussions and record grades in a gradebook. - Use case: A college moves its courses online. Each course gets a Canvas site where the instructor publishes materials and assignments with due dates, students take part in course discussions, and marks go into a gradebook that shows each learner's progress. - Sources: https://github.com/instructure/canvas-lms, https://github.com/instructure/canvas-lms/wiki, https://www.instructure.com/canvas ### changedetection.io 0.60.10 - Page: https://readystack.dev/products/changedetection - Image: readystack/changedetection:0.60.10-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/changedetection/tags?name=0.60.10-CE-ubuntu24.04-r1) - Pull: docker pull readystack/changedetection:0.60.10-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/changedetection:0.60.10-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/changedetection#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/changedetection/recipe (public in part; every file with a free account) - Upstream source: https://github.com/dgtlmoon/changedetection.io/tree/16974bf351cd68b1978af9494082b75efadaa8e0 (commit 16974bf351cd68b1978af9494082b75efadaa8e0) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (changedetection) - About: changedetection.io monitors web pages for updates and sends notifications when content changes. It stores all watch data and history locally in simple JSON files, requiring no external database or complex infrastructure to operate. - Who uses it: People and teams who watch web pages for changes to prices, stock levels, job listings or policies. - Why: changedetection.io checks web pages on a schedule you set, can watch only the part of a page you choose, and sends a notification when that content changes. - Use case: A small shop tracks the prices its suppliers publish. changedetection.io checks each supplier page during business hours, watches only the price element picked with a CSS selector, and sends an email or webhook when it changes, so nobody has to reload the pages by hand. - Sources: https://github.com/dgtlmoon/changedetection.io ### cloudflared 2026.10.5 - Page: https://readystack.dev/products/cloudflared - Image: readystack/cloudflared:2026.10.5-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/cloudflared/tags?name=2026.10.5-CE-ubuntu24.04-r1) - Pull: docker pull readystack/cloudflared:2026.10.5-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/cloudflared:2026.10.5-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/cloudflared#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/cloudflared/recipe (public in part; every file with a free account) - Upstream source: https://github.com/cloudflare/cloudflared/tree/99b2eb2c0152862af2b1abf7c7b4e2170a46b9fe (commit 99b2eb2c0152862af2b1abf7c7b4e2170a46b9fe) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (cloudflared) - Who uses it: Teams who want to publish or reach internal services through Cloudflare Tunnel without opening inbound firewall ports. - Why: cloudflared is the client for Cloudflare Tunnel. It makes outbound-only connections from your network, and requests for your services come back through them, so your servers need no public IP address. - Use case: A team runs an internal dashboard on a server with no public address. cloudflared on that network opens a Cloudflare Tunnel; users reach the dashboard through the tunnel, and the firewall keeps every inbound port closed. - Sources: https://github.com/cloudflare/cloudflared, https://developers.cloudflare.com/cloudflare-one/networks/connectors/cloudflare-tunnel/ ### Coder v2.38.3 - Page: https://readystack.dev/products/coder - Image: readystack/coder:v2.38.3-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/coder/tags?name=v2.38.3-CE-ubuntu24.04-r2) - Pull: docker pull readystack/coder:v2.38.3-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/coder:v2.38.3-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/coder#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/coder/recipe (public in part; every file with a free account) - Upstream source: https://github.com/coder/coder/tree/5bb296e4d5e55e7de39e0d1ab89493e205d6c4ac (commit 5bb296e4d5e55e7de39e0d1ab89493e205d6c4ac) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (coder) - About: Coder lets teams provision secure, remote development environments on demand. Users access consistent workspaces from any device, while administrators manage infrastructure via standard provisioning tools. - Who uses it: Platform teams who give developers standard, ready-to-use development environments on infrastructure they control. - Why: Coder creates development workspaces from templates that administrators maintain. Developers connect from their own editor, and workspaces left idle shut down automatically. - Use case: New developers on a large codebase spend days setting up laptops. With Coder, the platform team writes one workspace template; a new developer creates a workspace from it and starts work right away, and workspaces left idle overnight shut down on their own. - Sources: https://github.com/coder/coder, https://coder.com/docs ### Consul v1.16.4 - Page: https://readystack.dev/products/consul - Image: readystack/consul:v1.16.4-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/consul/tags?name=v1.16.4-CE-ubuntu24.04-r4) - Pull: docker pull readystack/consul:v1.16.4-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/consul:v1.16.4-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/consul#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/consul/recipe (public in part; every file with a free account) - Upstream source: https://github.com/hashicorp/consul/tree/2b5841d3f6243fc9b24a5f223daeef69761e0317 (commit 2b5841d3f6243fc9b24a5f223daeef69761e0317) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (consul) - Who uses it: Operations and platform teams who run many services across servers, data centres or clusters that need to find each other. - Why: Consul keeps a registry of services. Services register themselves and find each other over DNS or HTTP, health checks keep traffic away from failing instances, and an HTTP API stores shared configuration. - Use case: A team runs internal services on virtual machines whose addresses change as machines are replaced. Each service registers with Consul and looks up the others by name over DNS; when an instance fails its health check, it drops out of the answers until it recovers. - Sources: https://github.com/hashicorp/consul/blob/v1.16.4/README.md, https://developer.hashicorp.com/consul/docs/intro ### CoreDNS v1.14.2 - Page: https://readystack.dev/products/coredns - Image: readystack/coredns:v1.14.2-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/coredns/tags?name=v1.14.2-CE-ubuntu24.04-r1) - Pull: docker pull readystack/coredns:v1.14.2-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/coredns:v1.14.2-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/coredns#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/coredns/recipe (public in part; every file with a free account) - Upstream source: https://github.com/coredns/coredns/tree/dd1df4f5db93767a44e37638df44969503b320d2 (commit dd1df4f5db93767a44e37638df44969503b320d2) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (65532:65532) - Who uses it: Platform engineers and network administrators who run DNS for Kubernetes clusters or internal networks. - Why: CoreDNS is a DNS server built from plugins. It can serve zone files, forward and cache queries, and answer for Kubernetes services, each feature switched on in its configuration file. - Use case: In a Kubernetes cluster, CoreDNS answers pods' lookups for the cluster's service names and forwards other names to upstream resolvers. On an office network, the same server can serve internal names from a zone file and cache lookups for everything else. - Sources: https://github.com/coredns/coredns, https://coredns.io/manual/toc/ ### CrowdSec v1.8.1 - Page: https://readystack.dev/products/crowdsec - Image: readystack/crowdsec:v1.8.1-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/crowdsec/tags?name=v1.8.1-CE-ubuntu24.04-r4) - Pull: docker pull readystack/crowdsec:v1.8.1-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/crowdsec:v1.8.1-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/crowdsec#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/crowdsec/recipe (public in part; every file with a free account) - Upstream source: https://github.com/crowdsecurity/crowdsec/tree/909b5157986a2b2c2163300fdaef5ed01289f7d2 (commit 909b5157986a2b2c2163300fdaef5ed01289f7d2) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (crowdsec) - Who uses it: System administrators, DevOps and SRE teams who need to spot and block attacks on internet-facing servers. - Why: CrowdSec's Security Engine reads logs and HTTP requests, detects behaviour such as brute force and scans, and has a firewall or reverse proxy block the offending IP addresses. - Use case: A web server's logs show constant password guessing against its login page. CrowdSec parses those logs, recognises the brute-force pattern, and a remediation component on the firewall blocks the source address, without anyone writing ban rules by hand. Attacks it reports feed a shared community blocklist. - Sources: https://github.com/crowdsecurity/crowdsec, https://docs.crowdsec.net/ ### Discourse v2026.9.1 - Page: https://readystack.dev/products/discourse - Image: readystack/discourse:v2026.9.1-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/discourse/tags?name=v2026.9.1-CE-ubuntu24.04-r1) - Pull: docker pull readystack/discourse:v2026.9.1-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/discourse:v2026.9.1-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/discourse#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/discourse/recipe (public in part; every file with a free account) - Upstream source: https://github.com/discourse/discourse/tree/4f3dc460226b37e001c5f42db397cc891a357701 (commit 4f3dc460226b37e001c5f42db397cc891a357701) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (discourse) - About: Discourse enables your team to build a dedicated online community by facilitating organized discussions and knowledge sharing. It provides a robust platform for managing user interactions and preserving institutional memory without relying on external social networks. - Who uses it: Organisations, open-source projects and online communities that want a discussion forum under their own control. - Why: Discourse is a community discussion platform. Members start topics and reply in threads, talk in built-in chat, and the site can be customised with themes and plugins. - Use case: A software project moves user questions out of private email into a public Discourse forum. Questions and answers stay visible as topics, so the next person with the same problem finds the earlier answer, and maintainers use chat for quick conversations. - Sources: https://github.com/discourse/discourse ### Distribution Registry v3.1.2 - Page: https://readystack.dev/products/registry - Image: readystack/registry:v3.1.2-CE-ubuntu24.04-r5 (https://hub.docker.com/r/readystack/registry/tags?name=v3.1.2-CE-ubuntu24.04-r5) - Pull: docker pull readystack/registry:v3.1.2-CE-ubuntu24.04-r5 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/registry:v3.1.2-CE-ubuntu24.04-r5 - Hermetic Build Kit: https://readystack.dev/products/registry#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/registry/recipe (public in part; every file with a free account) - Upstream source: https://github.com/distribution/distribution/tree/3220848f15d9279c66a41aa0a257469e6aede1e9 (commit 3220848f15d9279c66a41aa0a257469e6aede1e9) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (registry) - Who uses it: Teams who want to store and distribute their container images on infrastructure they control. - Why: Distribution Registry is the open-source server that stores container images and other content and serves them using the OCI Distribution Specification. - Use case: A company's build system produces container images that must stay inside its network. It runs Distribution Registry internally: the build pipeline pushes each image there, and every server pulls from it, so image storage and distribution are fully under the company's control. - Sources: https://github.com/distribution/distribution, https://distribution.github.io/distribution/ ### Docker 29.9.2 - Page: https://readystack.dev/products/docker - Image: readystack/docker:29.9.2-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/docker/tags?name=29.9.2-CE-ubuntu24.04-r3) - Pull: docker pull readystack/docker:29.9.2-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/docker:29.9.2-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/docker#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/docker/recipe (public in part; every file with a free account) - Upstream source: https://github.com/moby/moby/tree/0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c (commit 0367cbeb49b9d98cb0b4f51e95f7b54b4803e76c) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (rootless) - Who uses it: Developers and operations teams who build, ship and run applications in containers. - Why: Docker Engine is the daemon, API and command-line client that build container images and create and manage containers, networks and volumes. - Use case: A team needs a container engine on a shared build host but does not want the daemon running as root. Docker's rootless mode runs the daemon and its containers inside a user namespace as an ordinary user, which limits the damage a vulnerability in the daemon or the container runtime can do. - Sources: https://docs.docker.com/engine/, https://docs.docker.com/engine/security/rootless/, https://github.com/docker-library/docs/blob/master/docker/content.md ### DocuSeal 3.3.3 - Page: https://readystack.dev/products/docuseal - Image: readystack/docuseal:3.3.3-CE-alpine-r3 (https://hub.docker.com/r/readystack/docuseal/tags?name=3.3.3-CE-alpine-r3) - Pull: docker pull readystack/docuseal:3.3.3-CE-alpine-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/docuseal:3.3.3-CE-alpine-r3 - Hermetic Build Kit: https://readystack.dev/products/docuseal#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/docuseal/recipe (public in part; every file with a free account) - Upstream source: https://github.com/docusealco/docuseal/tree/8f8f69f0bc6ac2e59746cd6efac54a852289bec3 (commit 8f8f69f0bc6ac2e59746cd6efac54a852289bec3) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (docuseal) - About: DocuSeal enables teams to securely sign documents using a self-hosted platform that ensures full data sovereignty. It provides a simple interface for managing digital agreements without relying on third-party cloud services. - Who uses it: Businesses and teams, such as HR and sales, who send documents for signature and keep them on their own server. - Why: DocuSeal turns a PDF into a form with signature, date and other fields, sends it to one or more signers by email, and signs the completed PDF electronically so the signature can be verified. - Use case: An HR team sends each new hire a contract to sign. They place signature, date and checkbox fields on the PDF once in the form builder, then send it; each hire fills it in and signs on a phone or laptop, and the signed PDFs are stored on the company's own server. - Sources: https://github.com/docusealco/docuseal ### Drupal 11.4.11 - Page: https://readystack.dev/products/drupal - Image: readystack/drupal:11.4.11-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/drupal/tags?name=11.4.11-CE-ubuntu24.04-r2) - Pull: docker pull readystack/drupal:11.4.11-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/drupal:11.4.11-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/drupal#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/drupal/recipe (public in part; every file with a free account) - Upstream source: https://github.com/drupal/recommended-project/tree/8a28d5d06552a136852de8a93fc597a146631536 (commit 8a28d5d06552a136852de8a93fc597a146631536) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (www-data) - Who uses it: Government agencies, universities, media companies and other organisations that build content-rich websites. - Why: Drupal is content management software for websites and applications built on structured content. Its core does a lot on its own and can be extended with free, open-source modules. - Use case: A university needs department pages, event listings and staff profiles in one site. In Drupal editors fill in structured content, themes control how it is presented, and modules add features before anyone writes custom code. - Sources: https://github.com/drupal/drupal, https://www.drupal.org/about ### ERPNext v16.52.1 - Page: https://readystack.dev/products/erpnext - Image: readystack/erpnext:v16.52.1-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/erpnext/tags?name=v16.52.1-CE-ubuntu24.04-r3) - Pull: docker pull readystack/erpnext:v16.52.1-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/erpnext:v16.52.1-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/erpnext#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/erpnext/recipe (public in part; every file with a free account) - Upstream source: https://github.com/frappe/erpnext/tree/ade850bbd6a7412e9994a9637d2c5c713771632a (commit ade850bbd6a7412e9994a9637d2c5c713771632a) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (frappe) - About: ERPNext provides a complete open-source ERP suite for managing business operations. It integrates core financial, inventory, and HR functions into a single platform. - Who uses it: Businesses that want accounting, inventory, sales, manufacturing and projects in one system. - Why: ERPNext is an open-source ERP: invoices, stock, sales orders, suppliers, production, assets and project timesheets in one application instead of separate tools. - Use case: A small manufacturer tracks orders in spreadsheets, stock in another tool and invoices in a third. In ERPNext sales orders, stock levels, material consumption and invoices live in one system, so the books, the warehouse and the production floor work from the same records. - Sources: https://github.com/frappe/erpnext ### etcd v3.7.3 - Page: https://readystack.dev/products/etcd - Image: readystack/etcd:v3.7.3-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/etcd/tags?name=v3.7.3-CE-ubuntu24.04-r1) - Pull: docker pull readystack/etcd:v3.7.3-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/etcd:v3.7.3-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/etcd#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/etcd/recipe (public in part; every file with a free account) - Upstream source: https://github.com/etcd-io/etcd/tree/0a173d0410a96d01091b484daae81365bbcde57e (commit 0a173d0410a96d01091b484daae81365bbcde57e) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (etcd) - Who uses it: Platform engineers who run Kubernetes control planes, and developers of distributed systems that need consistent shared state. - Why: etcd is a distributed, reliable key-value store for a distributed system's most critical data. It replicates writes across its members with the Raft consensus algorithm, so the data stays consistent when a member fails. - Use case: A Kubernetes control plane keeps all of its API data in etcd. Running etcd as a cluster of members on separate machines means the cluster's state survives the loss of one machine, and the remaining members keep serving reads and writes. - Sources: https://github.com/etcd-io/etcd, https://kubernetes.io/docs/concepts/overview/components/ ### flannel v0.28.10 - Page: https://readystack.dev/products/flannel - Image: readystack/flannel:v0.28.10-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/flannel/tags?name=v0.28.10-CE-ubuntu24.04-r1) - Pull: docker pull readystack/flannel:v0.28.10-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/flannel:v0.28.10-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/flannel#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/flannel/recipe (public in part; every file with a free account) - Upstream source: https://github.com/flannel-io/flannel/tree/0f70536f15f281279dab39fb9d575c646c7eea34 (commit 0f70536f15f281279dab39fb9d575c646c7eea34) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (flannel) - Who uses it: Kubernetes cluster operators who need a simple network that connects pods across nodes. - Why: flannel makes every pod's address reachable across the cluster. An agent on each host leases that host a subnet from a shared range and carries traffic between hosts, for example over VXLAN. - Use case: A team building an on-premises Kubernetes cluster needs pods on different nodes to reach each other without port mapping. flannel runs on every node, gives each node a subnet of the pod address range, and forwards pod traffic between nodes over VXLAN. - Sources: https://github.com/flannel-io/flannel ### flannel CNI plugin v1.9.1-flannel3 - Page: https://readystack.dev/products/flannelcniplugin - Image: readystack/flannelcniplugin:v1.9.1-flannel3-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/flannelcniplugin/tags?name=v1.9.1-flannel3-CE-ubuntu24.04-r1) - Pull: docker pull readystack/flannelcniplugin:v1.9.1-flannel3-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/flannelcniplugin:v1.9.1-flannel3-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/flannelcniplugin#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/flannelcniplugin/recipe (public in part; every file with a free account) - Upstream source: https://github.com/flannel-io/cni-plugin/tree/b380f201008e9bed159703846cf10d3c50b4f9ce (commit b380f201008e9bed159703846cf10d3c50b4f9ce) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (flannelcniplugin) - Who uses it: Kubernetes cluster operators who use flannel for pod networking. - Why: The flannel CNI plugin connects each new pod to the flannel network: it reads the subnet flannel leased to the host and configures a standard CNI plugin, such as bridge, with it. - Use case: When the container runtime starts a pod on a node running flannel, it calls the flannel CNI plugin. The plugin reads the node's flannel subnet settings and delegates to the bridge plugin, which gives the pod an address from that subnet, so new pods join the cluster network with no manual setup. - Sources: https://github.com/flannel-io/cni-plugin ### Fluent Bit v5.1.5 - Page: https://readystack.dev/products/fluentbit - Image: readystack/fluentbit:v5.1.5-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/fluentbit/tags?name=v5.1.5-CE-ubuntu24.04-r1) - Pull: docker pull readystack/fluentbit:v5.1.5-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/fluentbit:v5.1.5-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/fluentbit#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/fluentbit/recipe (public in part; every file with a free account) - Upstream source: https://github.com/fluent/fluent-bit/tree/0039c4f0d1b530bedd8448df2fa4c301d58a5b91 (commit 0039c4f0d1b530bedd8448df2fa4c301d58a5b91) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (fluentbit) - Who uses it: Operations and platform teams who collect logs, metrics and traces from servers, containers and devices. - Why: Fluent Bit is a lightweight telemetry agent. It collects logs, metrics and traces from many sources, filters and processes them, and forwards them to the destinations you choose. - Use case: A team runs applications on many servers and containers and wants all their logs in one central store. Fluent Bit on each host reads the log files, parses and filters the records, and forwards them to the team's log backend, while using little CPU and memory on the hosts. - Sources: https://github.com/fluent/fluent-bit, https://docs.fluentbit.io/manual/about/what-is-fluent-bit ### Frappe CRM v1.90.0 - Page: https://readystack.dev/products/frappecrm - Image: readystack/frappecrm:v1.90.0-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/frappecrm/tags?name=v1.90.0-CE-ubuntu24.04-r1) - Pull: docker pull readystack/frappecrm:v1.90.0-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/frappecrm:v1.90.0-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/frappecrm#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/frappecrm/recipe (public in part; every file with a free account) - Upstream source: https://github.com/frappe/crm/tree/36bd8859f2a6345a620477bc708d0546e8c3f08a (commit 36bd8859f2a6345a620477bc708d0546e8c3f08a) - Original grade: A (score 100 of 100), pushed 2026-10-30, scanned 2026-10-30 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-30 with the network off - Runs as: Non-root (frappe) - Who uses it: Sales teams that want a simple, customisable CRM they can host themselves. - Why: Frappe CRM tracks leads and deals. Each one has a single page with its activities, comments, notes and tasks, and a Kanban board shows every deal's stage. - Use case: A small sales team tracks prospects in spreadsheets and email threads. In Frappe CRM each lead has one page with its notes, tasks and activity, and the team drags its leads and deals across its own stages on a Kanban board, so anyone can see where every deal stands. - Sources: https://github.com/frappe/crm ### Ghost v6.72.0 - Page: https://readystack.dev/products/ghost - Image: readystack/ghost:v6.72.0-CE-ubuntu24.04-r5 (https://hub.docker.com/r/readystack/ghost/tags?name=v6.72.0-CE-ubuntu24.04-r5) - Pull: docker pull readystack/ghost:v6.72.0-CE-ubuntu24.04-r5 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/ghost:v6.72.0-CE-ubuntu24.04-r5 - Hermetic Build Kit: https://readystack.dev/products/ghost#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/ghost/recipe (public in part; every file with a free account) - Upstream source: https://github.com/TryGhost/Ghost/tree/412dff5a21cc8ffbfec0b15554eebcb53194ad15 (commit 412dff5a21cc8ffbfec0b15554eebcb53194ad15) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (node) - Who uses it: Writers, independent publishers and media teams who run a publication with a newsletter and paid memberships. - Why: Ghost is an open-source publishing platform for running a website, email newsletters, memberships and paid subscriptions from one place. - Use case: A journalist leaves a newspaper to publish independently. On Ghost each article appears on the website and goes out as a newsletter, readers sign up as free or paying members, and the publication and its audience stay on a site the writer controls. - Sources: https://github.com/TryGhost/Ghost, https://ghost.org/docs/introduction/ ### Gitea v28.2.0 - Page: https://readystack.dev/products/gitea - Image: readystack/gitea:v28.2.0-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/gitea/tags?name=v28.2.0-CE-ubuntu24.04-r2) - Pull: docker pull readystack/gitea:v28.2.0-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/gitea:v28.2.0-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/gitea#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/gitea/recipe (public in part; every file with a free account) - Upstream source: https://github.com/go-gitea/gitea/tree/829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1 (commit 829b49c1ae96015e345f9d2a0eb1ea7acd5f31e1) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (gitea) - About: Gitea provides a complete, self-contained Git service that eliminates complex infrastructure requirements. Users gain immediate access to web and SSH repositories without managing external databases or orchestration tools. - Who uses it: Development teams who want a self-hosted Git service with code review, issues and CI/CD in one place. - Why: Gitea is a self-hosted, all-in-one software development service: Git hosting, code review, issue tracking, project boards, a wiki, a package registry and CI/CD in one application. - Use case: A company must keep its source code on its own servers. Gitea gives its developers repositories, pull requests with code review, issues and a wiki on one internal server, and its built-in CI/CD builds and tests each change there too. - Sources: https://github.com/go-gitea/gitea, https://docs.gitea.com/ ### Grafana v13.3.0 - Page: https://readystack.dev/products/grafana - Image: readystack/grafana:v13.3.0-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/grafana/tags?name=v13.3.0-CE-ubuntu24.04-r1) - Pull: docker pull readystack/grafana:v13.3.0-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/grafana:v13.3.0-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/grafana#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/grafana/recipe (public in part; every file with a free account) - Upstream source: https://github.com/grafana/grafana/tree/752e3462ff71a43a5c1fb62d00a482fa2dc0ee6a (commit 752e3462ff71a43a5c1fb62d00a482fa2dc0ee6a) - Original grade: A (score 100 of 100), pushed 2026-10-30, scanned 2026-10-30 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (grafana) - About: Grafana provides a unified observability platform for visualizing metrics and logs. It enables teams to monitor system health and troubleshoot issues through customizable, real-time dashboards. - Who uses it: Operations, SRE and development teams who need dashboards and alerts over their metrics, logs and traces. - Why: Grafana queries, visualises and alerts on metrics, logs and traces wherever they are stored, and lets teams build and share dashboards that mix several data sources. - Use case: An operations team keeps server metrics in one database and application logs in another. A Grafana dashboard shows both for each service, an alert rule notifies the on-call engineer when errors climb, and the engineer moves from the graph to the matching logs with the same filters. - Sources: https://github.com/grafana/grafana, https://grafana.com/docs/grafana/latest/introduction/ ### HAProxy 3.4.6 - Page: https://readystack.dev/products/haproxy - Image: readystack/haproxy:3.4.6-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/haproxy/tags?name=3.4.6-CE-ubuntu24.04-r4) - Pull: docker pull readystack/haproxy:3.4.6-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/haproxy:3.4.6-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/haproxy#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/haproxy/recipe (public in part; every file with a free account) - Upstream source: https://git.haproxy.org/git/haproxy-3.4 (commit 56332c50b5291cfbbfd440d958adc988fbf87e2f) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (haproxy) - Who uses it: Operations teams and site reliability engineers who run busy websites and services that need load balancing and high availability. - Why: HAProxy is a reverse proxy and load balancer for TCP and HTTP applications. It spreads traffic across servers, checks their health, terminates TLS, and can rate-limit or block abusive clients. - Use case: An online shop runs its web application on several servers. HAProxy in front terminates HTTPS, sends each request to a server that passes its health checks, keeps a shopper's session on the same server, and slows down or blocks clients that send abusive request rates. - Sources: https://www.haproxy.org/, https://github.com/haproxy/haproxy/blob/master/doc/intro.txt ### Harbor v2.15.4 - Page: https://readystack.dev/products/harbor - Image: readystack/harbor:v2.15.4-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/harbor/tags?name=v2.15.4-CE-ubuntu24.04-r4) - Pull: docker pull readystack/harbor:v2.15.4-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/harbor:v2.15.4-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/harbor#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/harbor/recipe (public in part; every file with a free account) - Upstream source: https://github.com/goharbor/harbor/tree/0a6bf30d54e779962ad5b862fc67e3e9f6b010d8 (commit 0a6bf30d54e779962ad5b862fc67e3e9f6b010d8) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (harbor) - Who uses it: Platform and DevOps teams who run their own container registry for Kubernetes and other container platforms. - Why: Harbor is an open-source registry that stores container images, scans them for vulnerabilities, signs them, controls access by role, and replicates images between registries. - Use case: A company wants every image its clusters run to come from a registry it controls. Teams push images to their projects in Harbor, each image is scanned for vulnerabilities, a policy check keeps vulnerable images from being deployed, and replication copies images to a second registry near another data centre. - Sources: https://github.com/goharbor/harbor, https://goharbor.io/ ### Home Assistant 2026.10.4 - Page: https://readystack.dev/products/homeassistant - Image: readystack/homeassistant:2026.10.4-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/homeassistant/tags?name=2026.10.4-CE-ubuntu24.04-r1) - Pull: docker pull readystack/homeassistant:2026.10.4-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/homeassistant:2026.10.4-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/homeassistant#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/homeassistant/recipe (public in part; every file with a free account) - Upstream source: https://github.com/home-assistant/core/tree/357cae5c598dfcd7a0ea7dc5b1facccd4ec6037b (commit 357cae5c598dfcd7a0ea7dc5b1facccd4ec6037b) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (homeassistant) - About: Homeassistant unifies your smart home devices into a single, local interface. It allows you to automate routines and monitor systems without relying on external cloud services. - Who uses it: Home owners, tinkerers and DIY enthusiasts who want to automate their homes with local control and privacy. - Why: Home Assistant is open-source home automation. It brings devices from many makers together through integrations and runs automations locally, on a small computer or server at home. - Use case: A household has smart plugs, motion sensors and a thermostat from different makers, each with its own app. Home Assistant brings them into one dashboard and runs automations such as switching off the lights when everyone has left, on a local server, so the home's data stays in the house. - Sources: https://github.com/home-assistant/core, https://www.home-assistant.io/ ### InfluxDB v3.12.1 - Page: https://readystack.dev/products/influxdb - Image: readystack/influxdb:v3.12.1-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/influxdb/tags?name=v3.12.1-CE-ubuntu24.04-r2) - Pull: docker pull readystack/influxdb:v3.12.1-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/influxdb:v3.12.1-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/influxdb#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/influxdb/recipe (public in part; every file with a free account) - Upstream source: https://github.com/influxdata/influxdb/tree/692ea4a9943fc343c5fdf830d7dff82eef1f7fca (commit 692ea4a9943fc343c5fdf830d7dff82eef1f7fca) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (influxdb3) - Who uses it: Engineers who collect time-stamped data such as sensor readings, server metrics and network measurements. - Why: InfluxDB is a database built to collect, process and store event and time series data, and to answer queries on recent data quickly for dashboards, monitoring and automation. - Use case: A factory streams readings from its machine sensors every few seconds. InfluxDB ingests them as they arrive, a dashboard queries the latest values with SQL, and a Python plugin running inside the database reacts when a reading crosses a threshold. - Sources: https://github.com/influxdata/influxdb, https://docs.influxdata.com/influxdb3/core/ ### Jenkins 2.580.1 - Page: https://readystack.dev/products/jenkins - Image: readystack/jenkins:2.580.1-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/jenkins/tags?name=2.580.1-CE-ubuntu24.04-r4) - Pull: docker pull readystack/jenkins:2.580.1-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/jenkins:2.580.1-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/jenkins#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/jenkins/recipe (public in part; every file with a free account) - Upstream source: https://github.com/jenkinsci/jenkins/tree/500c80a425077d987b97f62be32887d4f32e9ffb (commit 500c80a425077d987b97f62be32887d4f32e9ffb) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (jenkins) - Who uses it: Development and DevOps teams who automate building, testing and deploying their software. - Why: Jenkins is an open-source automation server. With its plugins it runs the repetitive parts of the development workflow: builds, tests, static code analysis and deployments. - Use case: Each time a developer pushes code, Jenkins checks it out, builds it and runs the test suite, so a bug is caught as soon as it is introduced. When the tests pass on the main branch, the same pipeline deploys the build to a test environment. - Sources: https://github.com/jenkinsci/jenkins, https://www.jenkins.io/ ### Jitsi Meet stable-11248 - Page: https://readystack.dev/products/jitsi - Image: readystack/jitsi:stable-11248-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/jitsi/tags?name=stable-11248-CE-ubuntu24.04-r2) - Pull: docker pull readystack/jitsi:stable-11248-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/jitsi:stable-11248-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/jitsi#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/jitsi/recipe (public in part; every file with a free account) - Upstream source: https://github.com/jitsi/jitsi-meet/tree/f765042bf280cbd7dcd4a9bbdb63b09e9e4d3259 (commit f765042bf280cbd7dcd4a9bbdb63b09e9e4d3259) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (jitsi) - About: Jitsi Meet enables teams to host secure video conferences without external dependencies. It provides a self-hosted platform for private, scalable communication that keeps sensitive data within your infrastructure. - Who uses it: Organisations and individuals who want to run their own video meetings. - Why: Jitsi Meet is open-source video conferencing that works in the browser and in mobile apps, with screen sharing, chat, polls and raise-hand, and it can be embedded in other web applications. - Use case: A school wants video lessons without sending its classes through an outside service. It runs Jitsi Meet on its own server; teachers share a meeting link, students join from a browser or the mobile app, and the teacher shares slides and runs quick polls during the lesson. - Sources: https://github.com/jitsi/jitsi-meet ### Keycloak 26.8.1 - Page: https://readystack.dev/products/keycloak - Image: readystack/keycloak:26.8.1-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/keycloak/tags?name=26.8.1-CE-ubuntu24.04-r2) - Pull: docker pull readystack/keycloak:26.8.1-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/keycloak:26.8.1-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/keycloak#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/keycloak/recipe (public in part; every file with a free account) - Upstream source: https://github.com/keycloak/keycloak/tree/24ed1dadf3f246a555adb6d3d4a99e9b3003fb3b (commit 24ed1dadf3f246a555adb6d3d4a99e9b3003fb3b) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (keycloak) - Who uses it: Developers and identity teams who need login, single sign-on and user management for their applications. - Why: Keycloak is open-source identity and access management. Users sign in to Keycloak instead of each application, which gives single sign-on and sign-out, social login, LDAP user federation and fine-grained authorization. - Use case: A company builds several internal web apps and does not want each one to store passwords. Each app hands login to Keycloak over OpenID Connect; employees sign in once with their existing directory accounts, and logging out of one app logs them out of all of them. - Sources: https://github.com/keycloak/keycloak, https://www.keycloak.org/ ### kube-apiserver v1.36.6 - Page: https://readystack.dev/products/kubeapiserver - Image: readystack/kubeapiserver:v1.36.6-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/kubeapiserver/tags?name=v1.36.6-CE-ubuntu24.04-r1) - Pull: docker pull readystack/kubeapiserver:v1.36.6-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubeapiserver:v1.36.6-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/kubeapiserver#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kubeapiserver/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976 (commit 1b2171b110bb2a2542e1322035c6583ec86eb976) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (999:999) - Who uses it: Cluster administrators and platform engineers who build and run their own Kubernetes control plane. - Why: kube-apiserver serves the Kubernetes API. It validates and configures the cluster's objects, such as pods and services, and is the front end to the shared state that every other component works through. - Use case: When an engineer applies a new deployment, the request goes to kube-apiserver. It checks the request, runs admission control and stores the result in etcd; the scheduler, the controllers and the kubelet on each node watch the API server and act on the change. - Sources: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/, https://kubernetes.io/docs/concepts/overview/components/ ### kube-controller-manager v1.36.6 - Page: https://readystack.dev/products/kubecontrollermanager - Image: readystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/kubecontrollermanager/tags?name=v1.36.6-CE-ubuntu24.04-r1) - Pull: docker pull readystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/kubecontrollermanager#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kubecontrollermanager/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976 (commit 1b2171b110bb2a2542e1322035c6583ec86eb976) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (999:999) - Who uses it: Cluster administrators and platform engineers who build and run their own Kubernetes control plane. - Why: kube-controller-manager runs the control loops built into Kubernetes. Each controller watches the cluster's state through the API server and makes changes that move the current state towards the desired state. - Use case: A team asks for several replicas of a web server. When a node fails and its pods disappear, a controller in kube-controller-manager sees fewer replicas than requested and creates replacements; other controllers keep namespaces, endpoints and service accounts in line, without an operator stepping in. - Sources: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/, https://kubernetes.io/docs/concepts/overview/components/ ### kube-proxy v1.36.6 - Page: https://readystack.dev/products/kubeproxy - Image: readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/kubeproxy/tags?name=v1.36.6-CE-ubuntu24.04-r1) - Pull: docker pull readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/kubeproxy#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kubeproxy/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976 (commit 1b2171b110bb2a2542e1322035c6583ec86eb976) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (999:999) - Who uses it: Cluster administrators who run Kubernetes nodes. - Why: kube-proxy runs on each node and maintains the network rules that make Kubernetes Services work, forwarding traffic sent to a Service to one of the pods behind it. - Use case: A web front end calls a database through a Kubernetes Service. kube-proxy on every node keeps rules that send traffic for that Service to one of the database pods, wherever they run, and updates the rules as pods are replaced. - Sources: https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/, https://kubernetes.io/docs/concepts/overview/components/ ### kube-scheduler v1.36.6 - Page: https://readystack.dev/products/kubescheduler - Image: readystack/kubescheduler:v1.36.6-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/kubescheduler/tags?name=v1.36.6-CE-ubuntu24.04-r1) - Pull: docker pull readystack/kubescheduler:v1.36.6-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubescheduler:v1.36.6-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/kubescheduler#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kubescheduler/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976 (commit 1b2171b110bb2a2542e1322035c6583ec86eb976) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (999:999) - Who uses it: Cluster administrators and platform engineers who build and run their own Kubernetes control plane. - Why: kube-scheduler decides where each new pod runs. It filters out nodes that cannot run the pod, scores the rest against resources and constraints such as affinity, and binds the pod to the highest-scoring node. - Use case: A team deploys a memory-hungry service whose replicas must not share a node. kube-scheduler skips nodes without enough free memory, honours the anti-affinity rule and places each replica on a different suitable node; if no node fits, the pod waits until one does. - Sources: https://kubernetes.io/docs/concepts/scheduling-eviction/kube-scheduler/, https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/ ### kube-vip v1.3.1 - Page: https://readystack.dev/products/kubevip - Image: readystack/kubevip:v1.3.1-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/kubevip/tags?name=v1.3.1-CE-ubuntu24.04-r1) - Pull: docker pull readystack/kubevip:v1.3.1-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubevip:v1.3.1-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/kubevip#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kubevip/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kube-vip/kube-vip/tree/6da770eac1eed9409a9feaccda3d782c94424c24 (commit 6da770eac1eed9409a9feaccda3d782c94424c24) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (kubevip) - Who uses it: Administrators of on-premises, edge and bare-metal Kubernetes clusters who need a highly available control-plane address. - Why: kube-vip gives a Kubernetes cluster a virtual IP address and load balancer for its control plane and for LoadBalancer Services, announced over ARP or BGP, without external load-balancing hardware or software. - Use case: A team runs Kubernetes on its own servers with several control-plane nodes. kube-vip holds one virtual address for the API server on the elected leader and moves it to another control-plane node when the leader fails, so the worker nodes and administrators keep using the same address. - Sources: https://github.com/kube-vip/kube-vip, https://kube-vip.io/ ### Kubernetes v1.37.1 - Page: https://readystack.dev/products/kubernetes - Image: readystack/kubernetes:v1.37.1-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/kubernetes/tags?name=v1.37.1-CE-ubuntu24.04-r2) - Pull: docker pull readystack/kubernetes:v1.37.1-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubernetes:v1.37.1-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/kubernetes#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kubernetes/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubernetes/kubernetes/tree/f78e722310e50bcaca9276be22276d9e91d91308 (commit f78e722310e50bcaca9276be22276d9e91d91308) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (999) - About: Kubernetes manages your application containers across multiple servers, ensuring they run reliably and scale automatically as demand changes. This platform handles the underlying infrastructure complexity, allowing your team to focus on delivering features rather than maintaining server health. - Who uses it: Platform and operations teams who run containerised applications across many machines. - Why: Kubernetes is an open-source system for deploying, scaling and managing containerised applications across hosts, with service discovery, load balancing, automated rollouts and rollbacks, and self-healing. - Use case: A team runs an online shop as several services in containers. In Kubernetes they declare how many copies of each should run; Kubernetes places them on machines, restarts containers that fail, balances traffic between copies, and rolls out a new version step by step, and can roll it back to the previous version. - Sources: https://github.com/kubernetes/kubernetes, https://kubernetes.io/docs/concepts/overview/ ### Kubernetes Node v1.36.6 - Page: https://readystack.dev/products/kubernetesnode - Image: readystack/kubernetesnode:v1.36.6-CE-scratch-r1 (https://hub.docker.com/r/readystack/kubernetesnode/tags?name=v1.36.6-CE-scratch-r1) - Pull: docker pull readystack/kubernetesnode:v1.36.6-CE-scratch-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubernetesnode:v1.36.6-CE-scratch-r1 - Hermetic Build Kit: https://readystack.dev/products/kubernetesnode#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kubernetesnode/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976 (commit 1b2171b110bb2a2542e1322035c6583ec86eb976) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (65534:65534) - Who uses it: Cluster administrators who add their own Linux servers to a Kubernetes cluster, for example with kubeadm. - Why: A Kubernetes node runs the kubelet, a container runtime and network plugins. The kubelet registers the machine with the control plane and makes sure the pods assigned to it are running. - Use case: A team adds new servers to an on-premises cluster. Each server gets the kubelet, a container runtime and the network plugins; kubeadm join registers it with the control plane, and from then on the scheduler can place pods there and the kubelet keeps them running. - Sources: https://kubernetes.io/docs/concepts/architecture/nodes/, https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/, https://kubernetes.io/docs/setup/production-environment/tools/kubeadm/create-cluster-kubeadm/ ### Kubernetes VM Stack v1.36.6-kubevirt1.9.1 - Page: https://readystack.dev/products/kubernetesvmstack - Image: readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2 (https://hub.docker.com/r/readystack/kubernetesvmstack/tags?name=v1.36.6-kubevirt1.9.1-CE-scratch-r2) - Pull: docker pull readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2 - Hermetic Build Kit: https://readystack.dev/products/kubernetesvmstack#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/kubernetesvmstack/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976 (commit 1b2171b110bb2a2542e1322035c6583ec86eb976) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (65534:65534) - Who uses it: Teams that run a fleet of virtual machines on their own hardware and want them managed beside their containers. - Why: Kubernetes with KubeVirt adds virtual machines to the Kubernetes API: one API and one set of manifests for virtual machines and containers, on the same cluster and nodes. - Use case: A team has applications that still need full virtual machines and new services built as containers. On one Kubernetes cluster with KubeVirt they create, start, stop and migrate the virtual machines through the same Kubernetes API as their pods, and can move the VM workloads into containers over time. - Sources: https://kubevirt.io/, https://kubevirt.io/user-guide/, https://github.com/kubevirt/kubevirt, https://kubernetes.io/docs/concepts/overview/ ### Loki v3.7.9 - Page: https://readystack.dev/products/loki - Image: readystack/loki:v3.7.9-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/loki/tags?name=v3.7.9-CE-ubuntu24.04-r3) - Pull: docker pull readystack/loki:v3.7.9-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/loki:v3.7.9-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/loki#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/loki/recipe (public in part; every file with a free account) - Upstream source: https://github.com/grafana/loki/tree/d3b4a2f76bfc5625abee7ceb00b8896fa3c31549 (commit d3b4a2f76bfc5625abee7ceb00b8896fa3c31549) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (loki) - Who uses it: Operations and platform teams who collect logs from many services, especially on Kubernetes, and read them alongside metrics in Grafana. - Why: Loki is a log aggregation system that indexes only a set of labels for each log stream instead of the full text, which keeps it simpler to operate and cheaper to run. - Use case: A team runs many services on Kubernetes and needs their logs in one place. An agent ships each pod's logs to Loki with the pod's labels; when an alert fires, an engineer filters by those labels in Grafana and reads the matching logs next to the metrics. - Sources: https://github.com/grafana/loki, https://grafana.com/docs/loki/latest/ ### MariaDB 12.3.3 - Page: https://readystack.dev/products/mariadb - Image: readystack/mariadb:12.3.3-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/mariadb/tags?name=12.3.3-CE-ubuntu24.04-r3) - Pull: docker pull readystack/mariadb:12.3.3-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/mariadb:12.3.3-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/mariadb#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/mariadb/recipe (public in part; every file with a free account) - Upstream source: https://github.com/MariaDB/server/tree/83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e (commit 83e909fc2a0dbc394b4b683fb3fa2d7dcf26cc5e) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (mysql) - Who uses it: Developers and database administrators who need a relational SQL database for websites and business applications. - Why: MariaDB Server is an open-source relational database with an SQL interface, pluggable storage engines, replication and clustering, and JSON, GIS and vector search features. - Use case: A web application keeps its customers, orders and content in MariaDB. A replica on a second server receives every change, so reports can run there without slowing the main database, and a current copy of the data is ready if the primary server fails. - Sources: https://github.com/MariaDB/server, https://mariadb.org/about/ ### Mattermost v12.0.1 - Page: https://readystack.dev/products/mattermost - Image: readystack/mattermost:v12.0.1-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/mattermost/tags?name=v12.0.1-CE-ubuntu24.04-r1) - Pull: docker pull readystack/mattermost:v12.0.1-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/mattermost:v12.0.1-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/mattermost#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/mattermost/recipe (public in part; every file with a free account) - Upstream source: https://github.com/mattermost/mattermost/tree/987e57120dca630dadbcd2638064ab66a02bb81e (commit 987e57120dca630dadbcd2638064ab66a02bb81e) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (mattermost) - About: Mattermost provides a secure, self-hosted platform for team messaging and workflow automation. It enables technical teams to maintain full control over their communication infrastructure while ensuring data privacy and compliance within their own environment. - Who uses it: Technical teams, such as software, security and IT operations groups, that want team chat on infrastructure they control. - Why: Mattermost is a self-hosted collaboration platform with public and private channels, direct messages and threads on web, desktop and mobile, extended through webhooks, slash commands, bots and plugins. - Use case: A company's engineering and operations teams need chat that stays on their own servers. In Mattermost each service has a channel, monitoring alerts arrive through incoming webhooks, and during an incident the responders coordinate in one channel from a laptop or a phone. - Sources: https://github.com/mattermost/mattermost, https://docs.mattermost.com/ ### Metabase v0.64.3.5 - Page: https://readystack.dev/products/metabase - Image: readystack/metabase:v0.64.3.5-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/metabase/tags?name=v0.64.3.5-CE-ubuntu24.04-r1) - Pull: docker pull readystack/metabase:v0.64.3.5-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/metabase:v0.64.3.5-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/metabase#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/metabase/recipe (public in part; every file with a free account) - Upstream source: https://github.com/metabase/metabase/tree/125ddeaf5cc5bf07e8c8713d47834db69c9ada75 (commit 125ddeaf5cc5bf07e8c8713d47834db69c9ada75) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (metabase) - About: Metabase empowers teams to explore data and build dashboards without coding. It runs as a single, self-contained application that requires no external database setup, enabling immediate business intelligence access for any user. - Who uses it: Companies that want everyone, not only analysts, to ask questions of their data. - Why: Metabase is an open-source business intelligence tool. People explore data and build charts and dashboards without knowing SQL, and analysts use its SQL editor for more complex queries. - Use case: A start-up's product data sits in its application database and only engineers can query it. With Metabase connected to that database, the support lead charts tickets per customer without writing SQL, and the finance team gets a dashboard with filters it checks each week. - Sources: https://github.com/metabase/metabase ### Mimir 3.2.3 - Page: https://readystack.dev/products/mimir - Image: readystack/mimir:3.2.3-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/mimir/tags?name=3.2.3-CE-ubuntu24.04-r2) - Pull: docker pull readystack/mimir:3.2.3-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/mimir:3.2.3-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/mimir#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/mimir/recipe (public in part; every file with a free account) - Upstream source: https://github.com/grafana/mimir/tree/d0eb7d8bef4ca71d13b3bc475fe1e1785c145eb7 (commit d0eb7d8bef4ca71d13b3bc475fe1e1785c145eb7) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (mimir) - Who uses it: Platform and SRE teams who need to keep and query metrics from many clusters and teams over long periods. - Why: Grafana Mimir is horizontally scalable, highly available, multi-tenant long-term storage for Prometheus and OpenTelemetry metrics, with queries that aggregate series from many sources into a global view. - Use case: A company runs a Prometheus server in each of its clusters, each keeping only recent data. They all send metrics to Mimir, which keeps them durably in object storage, and engineers query months of history across every cluster at once from one place. - Sources: https://github.com/grafana/mimir, https://grafana.com/docs/mimir/latest/ ### Miniflux 2.3.4 - Page: https://readystack.dev/products/miniflux - Image: readystack/miniflux:2.3.4-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/miniflux/tags?name=2.3.4-CE-ubuntu24.04-r3) - Pull: docker pull readystack/miniflux:2.3.4-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/miniflux:2.3.4-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/miniflux#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/miniflux/recipe (public in part; every file with a free account) - Upstream source: https://github.com/miniflux/v2/tree/238c5614e584ebc87894e7d9f10bc91373a0b2c2 (commit 238c5614e584ebc87894e7d9f10bc91373a0b2c2) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (miniflux) - Who uses it: Individuals and small teams who follow news, blogs and podcasts through feeds and want a simple self-hosted reader. - Why: Miniflux is a minimalist, self-hosted feed reader designed for readability. It can fetch the full original article and removes pixel trackers and tracking parameters. - Use case: A developer follows many blogs, release notes and news sites. Miniflux checks every feed, shows unread articles in a clean layout that works from the keyboard, fetches the full text when a feed carries only a summary, and strips trackers along the way. - Sources: https://github.com/miniflux/v2, https://miniflux.app/ ### MinIO RELEASE.2025-10-15T17-29-55Z - Page: https://readystack.dev/products/minio - Image: readystack/minio:RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7 (https://hub.docker.com/r/readystack/minio/tags?name=RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7) - Pull: docker pull readystack/minio:RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/minio:RELEASE.2025-10-15T17-29-55Z-CE-ubuntu24.04-r7 - Hermetic Build Kit: https://readystack.dev/products/minio#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/minio/recipe (public in part; every file with a free account) - Upstream source: https://github.com/minio/minio/tree/9e49d5e7a648f00e26f2246f4dc28e6b07f8c84a (commit 9e49d5e7a648f00e26f2246f4dc28e6b07f8c84a) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (minio) - Who uses it: Teams who need object storage on their own hardware for backups, analytics data and application files. - Why: MinIO is open-source object storage compatible with an established cloud object-storage API, so existing tools and applications written for that API can store data on your own servers. - Use case: A team's backup software and data pipelines are written for cloud object storage, but the data must stay on site. They point those tools at MinIO on their own servers and keep their backups and datasets in buckets there. - Sources: https://github.com/minio/minio ### Moodle v5.3.0 - Page: https://readystack.dev/products/moodle - Image: readystack/moodle:v5.3.0-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/moodle/tags?name=v5.3.0-CE-ubuntu24.04-r4) - Pull: docker pull readystack/moodle:v5.3.0-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/moodle:v5.3.0-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/moodle#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/moodle/recipe (public in part; every file with a free account) - Upstream source: https://github.com/moodle/moodle/tree/42622298fe06f9626d988d60b2bf589bd8f850e8 (commit 42622298fe06f9626d988d60b2bf589bd8f850e8) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (www-data) - Who uses it: Schools, universities, companies and other organisations that run online learning and training. - Why: Moodle is an open-source learning management system that gives educators, administrators and learners one integrated system for courses, activities, assignments, grading and progress tracking. - Use case: A company trains staff in several offices. In Moodle the training team builds self-paced courses with forums and assignments, enrols each group of staff in the courses for their role, and tracks who has completed which course. - Sources: https://github.com/moodle/moodle, https://docs.moodle.org/en/About_Moodle, https://docs.moodle.org/en/Features ### Multus CNI v4.3.1 - Page: https://readystack.dev/products/multuscni - Image: readystack/multuscni:v4.3.1-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/multuscni/tags?name=v4.3.1-CE-ubuntu24.04-r1) - Pull: docker pull readystack/multuscni:v4.3.1-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/multuscni:v4.3.1-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/multuscni#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/multuscni/recipe (public in part; every file with a free account) - Upstream source: https://github.com/k8snetworkplumbingwg/multus-cni/tree/d61706810cc8be60381dcb66e6a2428d5eb2795a (commit d61706810cc8be60381dcb66e6a2428d5eb2795a) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (multuscni) - Who uses it: Kubernetes operators whose pods need more than one network interface, for example to reach a separate storage or management network. - Why: Multus CNI lets a pod have several network interfaces. It acts as a meta-plugin, calling other CNI plugins to attach extra networks alongside the cluster's default pod network. - Use case: A team runs workloads that must also sit on a separate VLAN. With Multus, each pod keeps its normal interface on the cluster network and gets an additional interface on the VLAN, described in a network attachment definition and created by another CNI plugin. - Sources: https://github.com/k8snetworkplumbingwg/multus-cni ### MySQL 9.7.4 - Page: https://readystack.dev/products/mysql - Image: readystack/mysql:9.7.4-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/mysql/tags?name=9.7.4-CE-ubuntu24.04-r2) - Pull: docker pull readystack/mysql:9.7.4-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/mysql:9.7.4-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/mysql#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/mysql/recipe (public in part; every file with a free account) - Upstream source: https://github.com/mysql/mysql-server/tree/780b506e8296a61f2a7067bf2087d32c78e0bb76 (commit 780b506e8296a61f2a7067bf2087d32c78e0bb76) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (mysql) - Who uses it: Developers and database administrators who need a relational SQL database for web and business applications. - Why: MySQL is a relational database server. Data lives in tables that applications add to, query and change with SQL, through a wide range of client libraries and APIs. - Use case: An online store keeps its products, customers and orders in MySQL tables. The web application reads and writes them with SQL through a client library for its language, and administrators manage the server, its users and its databases with MySQL's own tools. - Sources: https://github.com/mysql/mysql-server, https://dev.mysql.com/doc/refman/8.4/en/what-is-mysql.html ### NATS v2.15.2 - Page: https://readystack.dev/products/nats - Image: readystack/nats:v2.15.2-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/nats/tags?name=v2.15.2-CE-ubuntu24.04-r2) - Pull: docker pull readystack/nats:v2.15.2-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/nats:v2.15.2-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/nats#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/nats/recipe (public in part; every file with a free account) - Upstream source: https://github.com/nats-io/nats-server/tree/5a815f11a911efa2c88fd1dbfb18ed89a449bfc1 (commit 5a815f11a911efa2c88fd1dbfb18ed89a449bfc1) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (nats) - Who uses it: Developers and platform teams who connect services, edge devices and IoT systems through messaging. - Why: NATS is a simple, secure, open-source messaging system. Applications connect to a NATS server and exchange messages by subject, without knowing each other's network addresses. - Use case: A team splits an application into small services. Instead of each service keeping a list of the others' addresses, services publish and subscribe on named NATS subjects; a new service joins by subscribing, and nothing else has to be reconfigured. - Sources: https://github.com/nats-io/nats-server, https://docs.nats.io/nats-concepts/what-is-nats ### NetBox v4.7.3 - Page: https://readystack.dev/products/netbox - Image: readystack/netbox:v4.7.3-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/netbox/tags?name=v4.7.3-CE-ubuntu24.04-r3) - Pull: docker pull readystack/netbox:v4.7.3-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/netbox:v4.7.3-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/netbox#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/netbox/recipe (public in part; every file with a free account) - Upstream source: https://github.com/netbox-community/netbox/tree/3cd2c1d6469caed6c50e80eddd4cde863e0e2cf5 (commit 3cd2c1d6469caed6c50e80eddd4cde863e0e2cf5) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (netbox) - About: NetBox provides a centralized platform for modeling network infrastructure, enabling teams to document IP addresses and track device relationships. It supports collaborative planning and ensures accurate, real-time visibility into your organization’s physical and logical network topology. - Who uses it: Network engineers and data centre operators who need an accurate record of their network infrastructure. - Why: NetBox is a source of truth for network infrastructure. It models sites, racks, devices, cables, IP addresses, VLANs and circuits, and makes that data available through APIs to automation and monitoring tools. - Use case: A network team tracks IP addresses in a spreadsheet and rack layouts in diagrams that drift out of date. In NetBox they record every site, rack, device, cable and prefix in one place, and their automation scripts read the intended state through the API instead of guessing it. - Sources: https://github.com/netbox-community/netbox, https://netboxlabs.com/docs/netbox/ ### Nextcloud v35.0.2 - Page: https://readystack.dev/products/nextcloud - Image: readystack/nextcloud:v35.0.2-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/nextcloud/tags?name=v35.0.2-CE-ubuntu24.04-r4) - Pull: docker pull readystack/nextcloud:v35.0.2-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/nextcloud:v35.0.2-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/nextcloud#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/nextcloud/recipe (public in part; every file with a free account) - Upstream source: https://github.com/nextcloud/server/tree/ba900af933e61ffa005315b09d6454bfbbcbcc81 (commit ba900af933e61ffa005315b09d6454bfbbcbcc81) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (www-data) - Who uses it: Households, companies and public organisations that want file sync and sharing, calendars and contacts on a server they choose. - Why: Nextcloud stores files, contacts and calendars on your own server, keeps them in sync across devices, and lets you share them, with apps such as calendar, mail and video chat. - Use case: A small firm wants its documents off personal laptops and in one place it controls. With Nextcloud each person's files sync between the server and their devices, projects get shared folders, and a client gets access to just the files meant for them. - Sources: https://github.com/nextcloud/server ### NGINX 1.31.8 - Page: https://readystack.dev/products/nginx - Image: readystack/nginx:1.31.8-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/nginx/tags?name=1.31.8-CE-ubuntu24.04-r1) - Pull: docker pull readystack/nginx:1.31.8-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/nginx:1.31.8-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/nginx#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/nginx/recipe (public in part; every file with a free account) - Upstream source: https://github.com/nginx/nginx/tree/140aa942711868a8daeb95810bc9a81f272ada72 (commit 140aa942711868a8daeb95810bc9a81f272ada72) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (nginx) - Who uses it: Web developers and system administrators who serve websites and put applications behind a reverse proxy. - Why: NGINX is an HTTP web server, reverse proxy, content cache and load balancer, and can also proxy TCP, UDP and mail traffic. - Use case: A team serves a web application's pages and its API from the same address. NGINX serves the static files directly, terminates TLS, caches responses, and passes API requests to a pool of application servers with load balancing. - Sources: https://github.com/nginx/nginx, https://nginx.org/en/ ### NodeBB v4.16.5 - Page: https://readystack.dev/products/nodebb - Image: readystack/nodebb:v4.16.5-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/nodebb/tags?name=v4.16.5-CE-ubuntu24.04-r1) - Pull: docker pull readystack/nodebb:v4.16.5-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/nodebb:v4.16.5-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/nodebb#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/nodebb/recipe (public in part; every file with a free account) - Upstream source: https://github.com/NodeBB/NodeBB/tree/c3d8dc512292a376f19e06cb93512bdff2505102 (commit c3d8dc512292a376f19e06cb93512bdff2505102) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (nodebb) - About: Nodebb enables your community to host a fast, real-time discussion forum. It provides a customizable platform for users to engage in threaded conversations without relying on external services. - Who uses it: Communities and organisations that want a modern discussion forum they host themselves. - Why: NodeBB is forum software with real-time discussions and notifications, categories, user accounts and messaging, a read and write REST API, and plugins and themes for extra features. - Use case: An open-source project runs its support forum on NodeBB. Questions sit in categories, new replies and notifications appear without reloading the page, the forum works on phones as well as desktops, and plugins add the integrations the project needs. - Sources: https://github.com/NodeBB/NodeBB ### OpenBao v2.7.2 - Page: https://readystack.dev/products/openbao - Image: readystack/openbao:v2.7.2-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/openbao/tags?name=v2.7.2-CE-ubuntu24.04-r2) - Pull: docker pull readystack/openbao:v2.7.2-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/openbao:v2.7.2-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/openbao#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/openbao/recipe (public in part; every file with a free account) - Upstream source: https://github.com/openbao/openbao/tree/9e0a0d3c3504a0a00b45e61355afac5e35c78379 (commit 9e0a0d3c3504a0a00b45e61355afac5e35c78379) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (openbao) - About: OpenBao securely manages secrets, keys, and certificates through a unified API. This Linux Foundation fork provides essential vaulting capabilities without external database dependencies. - Who uses it: Platform, security and DevOps teams who need to store, control and audit access to secrets, keys and certificates. - Why: OpenBao is an identity-based secrets and encryption management system. It checks who each client is, hands out only the secrets its policy allows, and keeps detailed audit logs. - Use case: A team's applications keep database passwords in configuration files. With OpenBao each application authenticates, receives only the secrets its policy allows, and can get database credentials generated on demand that are revoked when their lease ends, while every access is recorded. - Sources: https://github.com/openbao/openbao, https://openbao.org/docs/what-is-openbao/ ### OpenProject v17.9.4 - Page: https://readystack.dev/products/openproject - Image: readystack/openproject:v17.9.4-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/openproject/tags?name=v17.9.4-CE-ubuntu24.04-r1) - Pull: docker pull readystack/openproject:v17.9.4-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/openproject:v17.9.4-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/openproject#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/openproject/recipe (public in part; every file with a free account) - Upstream source: https://github.com/opf/openproject/tree/7ef4007f9b355c9f1c71e288e9064e65547721e1 (commit 7ef4007f9b355c9f1c71e288e9064e65547721e1) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (app) - About: OpenProject delivers a verified, production-ready project management system with seed data and full documentation. This setup allows technical teams to quickly evaluate and deploy a stable, proven workflow solution without complex configuration. - Who uses it: Teams and organisations that plan and track projects and want their project data on their own servers. - Why: OpenProject is web-based project management software for tasks, bugs, roadmaps, Gantt-chart scheduling, time tracking, wikis and meeting minutes in a single platform. - Use case: A public agency runs several projects whose deadlines depend on each other. In OpenProject each project's work is planned on a Gantt chart, team members log the time they spend, meeting minutes sit next to the tasks, and the data stays on the agency's own servers. - Sources: https://github.com/opf/openproject ### OpenSearch 3.9.0 - Page: https://readystack.dev/products/opensearch - Image: readystack/opensearch:3.9.0-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/opensearch/tags?name=3.9.0-CE-ubuntu24.04-r3) - Pull: docker pull readystack/opensearch:3.9.0-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/opensearch:3.9.0-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/opensearch#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/opensearch/recipe (public in part; every file with a free account) - Upstream source: https://github.com/opensearch-project/OpenSearch/tree/4ee42a94e87f66fbf1e62a9871b1b87f91e02472 (commit 4ee42a94e87f66fbf1e62a9871b1b87f91e02472) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (opensearch) - About: OpenSearch delivers fast, scalable search and analytics capabilities for your data. This open-source engine enables you to index, search, and analyze information efficiently without proprietary licensing constraints. - Who uses it: Developers and operations teams who need full-text search, log analytics or vector search over large amounts of data. - Why: OpenSearch is an open-source search and analytics suite for full-text search, application monitoring, log analytics and vector search, with OpenSearch Dashboards for visualisation and management. - Use case: An online store wants full-text search across its product catalogue. It indexes the catalogue in OpenSearch and sends shoppers' queries there; the same cluster also stores the shop's application logs, which the operations team explores in OpenSearch Dashboards. - Sources: https://github.com/opensearch-project/OpenSearch, https://docs.opensearch.org/latest/about/ ### OpenTelemetry Collector v0.164.0 - Page: https://readystack.dev/products/otelcol - Image: readystack/otelcol:v0.164.0-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/otelcol/tags?name=v0.164.0-CE-ubuntu24.04-r1) - Pull: docker pull readystack/otelcol:v0.164.0-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/otelcol:v0.164.0-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/otelcol#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/otelcol/recipe (public in part; every file with a free account) - Upstream source: https://github.com/open-telemetry/opentelemetry-collector-releases/tree/bf626fce5c8053ac6ae9c6c5f4c408c8c182740e (commit bf626fce5c8053ac6ae9c6c5f4c408c8c182740e) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (otelcol) - Who uses it: Platform and observability teams who collect traces, metrics and logs from many applications and send them to backends. - Why: The OpenTelemetry Collector receives, processes and exports telemetry data in a vendor-agnostic way, so one agent or gateway can replace several separate collectors and agents. - Use case: A team's services emit traces and metrics in different formats, and the team is weighing a new monitoring backend. Every service sends its data to an OpenTelemetry Collector, which processes it and exports it to the current backend and the trial one at the same time, with no change to the services. - Sources: https://github.com/open-telemetry/opentelemetry-collector, https://opentelemetry.io/docs/collector/ ### Paperless-ngx v3.3.4 - Page: https://readystack.dev/products/paperlessngx - Image: readystack/paperlessngx:v3.3.4-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/paperlessngx/tags?name=v3.3.4-CE-ubuntu24.04-r4) - Pull: docker pull readystack/paperlessngx:v3.3.4-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/paperlessngx:v3.3.4-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/paperlessngx#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/paperlessngx/recipe (public in part; every file with a free account) - Upstream source: https://github.com/paperless-ngx/paperless-ngx/tree/558cb01a1ddc85b3753d8fcaf5f024e7456a5c82 (commit 558cb01a1ddc85b3753d8fcaf5f024e7456a5c82) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (paperless) - Who uses it: Households, freelancers and small offices who want to scan their paper and find any document again later. - Why: Paperless-ngx turns scanned paper into a searchable online archive. It runs OCR on each document, files it with tags, correspondents and types it can learn to suggest, and keeps the data on your own server. - Use case: A household scans its letters, bills and contracts as they arrive. Paperless-ngx reads each scan, adds searchable text, tags it with the sender and document type, and stores it as an archival PDF beside the original; when a warranty is needed years later, a full-text search finds it. - Sources: https://github.com/paperless-ngx/paperless-ngx, https://docs.paperless-ngx.com/ ### pause 3.10.2 - Page: https://readystack.dev/products/pause - Image: readystack/pause:3.10.2-CE-scratch-r1 (https://hub.docker.com/r/readystack/pause/tags?name=3.10.2-CE-scratch-r1) - Pull: docker pull readystack/pause:3.10.2-CE-scratch-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/pause:3.10.2-CE-scratch-r1 - Hermetic Build Kit: https://readystack.dev/products/pause#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/pause/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubernetes/kubernetes/tree/1b2171b110bb2a2542e1322035c6583ec86eb976 (commit 1b2171b110bb2a2542e1322035c6583ec86eb976) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (65535:65535) - Who uses it: Kubernetes cluster administrators. It is not normally run by hand: the container runtime starts it for every pod. - Why: The pause container is the infrastructure container of a pod. It starts first and keeps the pod's namespaces alive, so the pod's other containers can crash or restart without losing the pod's network setup. - Use case: When a web pod's application container crashes and restarts, the pod keeps its IP address and network configuration, because the pause container still holds them. Administrators meet it mostly in the container runtime's settings, where its image is named as the sandbox image. - Sources: https://github.com/kubernetes/kubernetes/blob/master/build/pause/linux/pause.c, https://kubernetes.io/docs/concepts/windows/intro/, https://kubernetes.io/docs/setup/production-environment/container-runtimes/ ### Perl 5.44.0 - Page: https://readystack.dev/products/perl - Image: readystack/perl:5.44.0-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/perl/tags?name=5.44.0-CE-ubuntu24.04-r1) - Pull: docker pull readystack/perl:5.44.0-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/perl:5.44.0-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/perl#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/perl/recipe (public in part; every file with a free account) - Upstream source: https://github.com/Perl/perl5/tree/e634cc838fb1785dfafb5d13b52807ea16b5c52c (commit e634cc838fb1785dfafb5d13b52807ea16b5c52c) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (perl) - Who uses it: System administrators, web developers and anyone who writes scripts that process text, files and data. - Why: Perl is a general-purpose programming language, first built for text manipulation and now used for system administration, web development, network programming and more, with a large collection of third-party modules on CPAN. - Use case: An administrator needs to pull errors out of large server logs every night and mail a summary. A short Perl script reads the logs, matches the lines with regular expressions, counts them per service and writes the report, using modules from CPAN for anything it does not do itself. - Sources: https://www.perl.org/about.html, https://github.com/Perl/perl5 ### Portainer 2.45.3 - Page: https://readystack.dev/products/portainer - Image: readystack/portainer:2.45.3-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/portainer/tags?name=2.45.3-CE-ubuntu24.04-r1) - Pull: docker pull readystack/portainer:2.45.3-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/portainer:2.45.3-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/portainer#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/portainer/recipe (public in part; every file with a free account) - Upstream source: https://github.com/portainer/portainer/tree/0fa764dc81c76bb7914d65d8e62b026d7c746899 (commit 0fa764dc81c76bb7914d65d8e62b026d7c746899) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (portainer) - Who uses it: Homelab operators, hobbyists, students and anyone experimenting with containers on their own hardware. - Why: Portainer Community Edition is a free, lightweight web interface for managing containers on container hosts and Kubernetes. - Use case: A hobbyist runs many self-hosted apps on a home server and loses track of them on the command line. Portainer shows every container on one web page, where they view its logs and statistics, open its console, and edit or remove it with a few clicks. - Sources: https://github.com/portainer/portainer, https://docs.portainer.io/user/docker/containers ### PostgreSQL 18.6 - Page: https://readystack.dev/products/postgresql - Image: readystack/postgresql:18.6-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/postgresql/tags?name=18.6-CE-ubuntu24.04-r4) - Pull: docker pull readystack/postgresql:18.6-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/postgresql:18.6-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/postgresql#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/postgresql/recipe (public in part; every file with a free account) - Upstream source: https://github.com/postgres/postgres/tree/724edf9bde9d356724ad384a2e196edc3c9f80f7 (commit 724edf9bde9d356724ad384a2e196edc3c9f80f7) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (postgres) - Who uses it: Developers and database administrators who need a reliable relational database for applications of any size. - Why: PostgreSQL is an open-source object-relational database that uses and extends SQL, known for reliability, data integrity and extensibility, with add-ons such as geospatial extensions. - Use case: A team builds a booking application in which double bookings must never happen. PostgreSQL's transactions make each booking all-or-nothing, an exclusion constraint rejects overlapping bookings, and the same database stores flexible JSON details and answers the reporting queries. - Sources: https://www.postgresql.org/about/ ### PostHog master-20261022-b904ac8 - Page: https://readystack.dev/products/posthog - Image: readystack/posthog:master-20261022-b904ac8-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/posthog/tags?name=master-20261022-b904ac8-CE-ubuntu24.04-r2) - Pull: docker pull readystack/posthog:master-20261022-b904ac8-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/posthog:master-20261022-b904ac8-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/posthog#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/posthog/recipe (public in part; every file with a free account) - Upstream source: https://github.com/PostHog/posthog/tree/b904ac8008e531c8aaeaf58e523cf97cff9fba41 (commit b904ac8008e531c8aaeaf58e523cf97cff9fba41) - Original grade: A (score 100 of 100), pushed 2026-10-30, scanned 2026-10-30 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-30 with the network off - Runs as: Non-root (posthog) - About: PostHog provides open-source product analytics and feature flag management to help teams track user behavior and experiment with new features. This self-hosted solution allows technical teams to maintain full data control while gaining actionable insights into application performance. - Who uses it: Product teams and developers who want to see how people use their web or mobile app. - Why: PostHog captures events from a product, automatically or through your own instrumentation, and lets you analyse user behaviour with visualisations or SQL. - Use case: A team ships a new sign-up flow and wants to know where people drop out. PostHog records each step as an event; the team charts how many users reach each step, finds the screen where people give up, and checks the effect after changing it. - Sources: https://github.com/PostHog/posthog ### Prometheus v3.15.1 - Page: https://readystack.dev/products/prometheus - Image: readystack/prometheus:v3.15.1-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/prometheus/tags?name=v3.15.1-CE-ubuntu24.04-r2) - Pull: docker pull readystack/prometheus:v3.15.1-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/prometheus:v3.15.1-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/prometheus#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/prometheus/recipe (public in part; every file with a free account) - Upstream source: https://github.com/prometheus/prometheus/tree/bae3eced0a5369e050e83ea73bc381d7c4b1a719 (commit bae3eced0a5369e050e83ea73bc381d7c4b1a719) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (prometheus) - About: Prometheus collects and stores time-series data for monitoring infrastructure and applications. It provides a robust query language and alerting capabilities to help teams track system performance and detect anomalies effectively. - Who uses it: Operations, SRE and platform teams who monitor servers and services and alert on problems. - Why: Prometheus is a monitoring system and time series database. It collects metrics from configured targets at intervals, stores them with labels, evaluates rules written in PromQL, and triggers alerts. - Use case: A team runs web services that expose request counts and latencies. Prometheus discovers the services, collects their metrics at intervals, and fires an alert when the error rate of any service stays above its threshold for several minutes. - Sources: https://github.com/prometheus/prometheus, https://prometheus.io/docs/introduction/overview/ ### Qdrant v1.20.0 - Page: https://readystack.dev/products/qdrant - Image: readystack/qdrant:v1.20.0-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/qdrant/tags?name=v1.20.0-CE-ubuntu24.04-r1) - Pull: docker pull readystack/qdrant:v1.20.0-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/qdrant:v1.20.0-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/qdrant#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/qdrant/recipe (public in part; every file with a free account) - Upstream source: https://github.com/qdrant/qdrant/tree/222b2e44ab1c3f17e8246396ead6558e45041df7 (commit 222b2e44ab1c3f17e8246396ead6558e45041df7) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (qdrant) - About: Qdrant provides a self-contained vector database for efficient similarity search and AI application development. It eliminates external dependencies by embedding storage directly within the service, simplifying infrastructure management for your team. - Who uses it: Developers building semantic search, recommendations or retrieval for AI applications. - Why: Qdrant is a vector database and similarity search engine. It stores vectors with a payload, finds the closest matches to a query vector, and filters results on the payload. - Use case: A support team wants its help-centre search to find articles by meaning, not exact words. Each article is turned into an embedding and stored in Qdrant with its product and language; a user's question is embedded the same way, and Qdrant returns the closest articles for that product. - Sources: https://github.com/qdrant/qdrant ### RabbitMQ 4.4.0 - Page: https://readystack.dev/products/rabbitmq - Image: readystack/rabbitmq:4.4.0-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/rabbitmq/tags?name=4.4.0-CE-ubuntu24.04-r2) - Pull: docker pull readystack/rabbitmq:4.4.0-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/rabbitmq:4.4.0-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/rabbitmq#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/rabbitmq/recipe (public in part; every file with a free account) - Upstream source: https://github.com/rabbitmq/rabbitmq-server/tree/24d5157cd415ef396c8ecd40a2d08c4d7ad3da9f (commit 24d5157cd415ef396c8ecd40a2d08c4d7ad3da9f) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (rabbitmq) - Who uses it: Developers and operations teams who connect applications, microservices and IoT devices through messaging. - Why: RabbitMQ is an open-source messaging and streaming broker. It supports several open protocols, including AMQP, MQTT and STOMP, and offers replicated queues and streams for data safety. - Use case: A web shop must not lose orders when its invoicing service is slow or down. The shop publishes each order to a RabbitMQ queue, the invoicing service works through the queue at its own pace, and a replicated queue keeps the orders safe if a broker node fails. - Sources: https://github.com/rabbitmq/rabbitmq-server, https://www.rabbitmq.com/ ### Rancher v2.15.2 - Page: https://readystack.dev/products/rancher - Image: readystack/rancher:v2.15.2-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/rancher/tags?name=v2.15.2-CE-ubuntu24.04-r3) - Pull: docker pull readystack/rancher:v2.15.2-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/rancher:v2.15.2-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/rancher#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/rancher/recipe (public in part; every file with a free account) - Upstream source: https://github.com/rancher/rancher/tree/272e65580ca92b9dc51e0f0f0f9ae9d6d356e3b8 (commit 272e65580ca92b9dc51e0f0f0f9ae9d6d356e3b8) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (rancher) - About: Rancher simplifies Kubernetes management by providing a unified interface to deploy, secure, and monitor clusters across any infrastructure. It enables teams to standardize operations and reduce complexity when handling multiple environments from a single control plane. - Who uses it: Organisations that deploy containers in production and run Kubernetes clusters in several places. - Why: Rancher is an open-source container management platform. It provisions and manages Kubernetes clusters from one place, with central authentication, access control and monitoring across all of them. - Use case: A company runs Kubernetes clusters in its own data centre and with a cloud provider. From Rancher, administrators create and upgrade the clusters, apply the same access policies to every team, and see each cluster's health in one view, while developers deploy their applications through its web interface. - Sources: https://github.com/rancher/rancher, https://ranchermanager.docs.rancher.com/getting-started/overview ### Redash v26.9.0 - Page: https://readystack.dev/products/redash - Image: readystack/redash:v26.9.0-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/redash/tags?name=v26.9.0-CE-ubuntu24.04-r3) - Pull: docker pull readystack/redash:v26.9.0-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/redash:v26.9.0-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/redash#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/redash/recipe (public in part; every file with a free account) - Upstream source: https://github.com/getredash/redash/tree/42fdf9d4a0fdb83841130ab78f69899a224f281b (commit 42fdf9d4a0fdb83841130ab78f69899a224f281b) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (redash) - About: Redash lets you query diverse data sources and build visual dashboards without writing complex code. This lean edition supports core integrations like PostgreSQL and Elasticsearch, while optional drivers enable additional connectors. - Who uses it: Analysts and engineers who write SQL and want to share the results with the rest of their organisation. - Why: Redash connects to many data sources. Users write SQL and other queries in the browser, turn the results into visualisations and dashboards, schedule refreshes and set alerts. - Use case: An analyst keeps answering the same questions about weekly sign-ups. In Redash she writes the query once, charts it, adds it to a team dashboard that refreshes on a schedule, and sets an alert that notifies her when sign-ups fall below an expected level. - Sources: https://github.com/getredash/redash ### Redis 8.10.2 - Page: https://readystack.dev/products/redis - Image: readystack/redis:8.10.2-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/redis/tags?name=8.10.2-CE-ubuntu24.04-r3) - Pull: docker pull readystack/redis:8.10.2-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/redis:8.10.2-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/redis#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/redis/recipe (public in part; every file with a free account) - Upstream source: https://github.com/redis/redis/tree/498ecd0d6d007db11ddb3aea9428552598a78622 (commit 498ecd0d6d007db11ddb3aea9428552598a78622) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (redis) - Who uses it: Developers building applications that need fast access to data: caches, sessions, queues, leaderboards and real-time features. - Why: Redis is an in-memory data store and data structure server: strings, lists, sets, hashes, sorted sets, streams and JSON, with key expiry, pub/sub, and search and vector query features. - Use case: A busy website keeps querying its main database for the same product pages and user sessions. With Redis in front, the site caches page data with an expiry time and stores sessions in memory, so most reads skip the main database and pages return faster. - Sources: https://github.com/redis/redis ### SeaweedFS 4.51 - Page: https://readystack.dev/products/seaweedfs - Image: readystack/seaweedfs:4.51-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/seaweedfs/tags?name=4.51-CE-ubuntu24.04-r1) - Pull: docker pull readystack/seaweedfs:4.51-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/seaweedfs:4.51-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/seaweedfs#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/seaweedfs/recipe (public in part; every file with a free account) - Upstream source: https://github.com/seaweedfs/seaweedfs/tree/153ab668c99731a6d29492bf6c61d0b4fa701101 (commit 153ab668c99731a6d29492bf6c61d0b4fa701101) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (seaweedfs) - Who uses it: Teams who need to store very large numbers of files, for applications, backups or analytics, on their own servers. - Why: SeaweedFS is a simple, highly scalable distributed storage system. One server program offers an object store, a POSIX file system and table storage over the same data, and capacity grows by adding volume servers. - Use case: A photo-sharing service stores huge numbers of small images that a single file server can no longer handle. SeaweedFS packs them into volumes spread across servers, reads each one with a single disk read, and grows by starting another volume server when space runs low. - Sources: https://github.com/seaweedfs/seaweedfs ### Syncthing v2.1.7 - Page: https://readystack.dev/products/syncthing - Image: readystack/syncthing:v2.1.7-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/syncthing/tags?name=v2.1.7-CE-ubuntu24.04-r2) - Pull: docker pull readystack/syncthing:v2.1.7-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/syncthing:v2.1.7-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/syncthing#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/syncthing/recipe (public in part; every file with a free account) - Upstream source: https://github.com/syncthing/syncthing/tree/d6d0181f7d466381c4b39ec8fd944c364f939b32 (commit d6d0181f7d466381c4b39ec8fd944c364f939b32) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (syncthing) - About: Syncthing synchronizes your files across devices using direct peer-to-peer connections, keeping your data private and under your control. It eliminates cloud dependencies by storing all state locally in a simple embedded database, ensuring complete self-hosted reliability. - Who uses it: Individuals and small teams who want files synced between their own computers without a cloud service in between. - Why: Syncthing continuously synchronises files between two or more computers in real time over encrypted, authenticated connections, with no central server that stores the data. - Use case: A photographer edits on a desktop at home and travels with a laptop. Syncthing keeps the project folders on both in sync whenever the two can reach each other, so the latest edits are on whichever machine is at hand, and the files are never stored on anyone else's server. - Sources: https://github.com/syncthing/syncthing, https://syncthing.net/ ### Tempo v3.1.1 - Page: https://readystack.dev/products/tempo - Image: readystack/tempo:v3.1.1-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/tempo/tags?name=v3.1.1-CE-ubuntu24.04-r3) - Pull: docker pull readystack/tempo:v3.1.1-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/tempo:v3.1.1-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/tempo#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/tempo/recipe (public in part; every file with a free account) - Upstream source: https://github.com/grafana/tempo/tree/9db7df79d2af105a90d96484e6403e1fda0d011e (commit 9db7df79d2af105a90d96484e6403e1fda0d011e) - Original grade: A (score 100 of 100), pushed 2026-10-30, scanned 2026-10-30 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (tempo) - Who uses it: Teams running many connected services who need distributed tracing to follow requests across them. - Why: Grafana Tempo is a distributed tracing backend that needs only object storage to run. It stores traces from instrumented services, and teams explore them in Grafana to find slow or failing requests. - Use case: Customers report that checkout is sometimes slow, and each checkout request passes through several services. Every service sends traces to Tempo; an engineer opens the slow traces in Grafana, sees which service call took most of the time, and knows where to look. - Sources: https://github.com/grafana/tempo ### Temporal v1.32.1 - Page: https://readystack.dev/products/temporal - Image: readystack/temporal:v1.32.1-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/temporal/tags?name=v1.32.1-CE-ubuntu24.04-r4) - Pull: docker pull readystack/temporal:v1.32.1-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/temporal:v1.32.1-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/temporal#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/temporal/recipe (public in part; every file with a free account) - Upstream source: https://github.com/temporalio/temporal/tree/af08a5e5f2dd40f545f2afac7780daaa6987001e (commit af08a5e5f2dd40f545f2afac7780daaa6987001e) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (temporal) - About: Temporal enables developers to build reliable applications by managing complex workflows and long-running processes automatically. It ensures that critical business logic executes correctly even when underlying infrastructure fails or restarts unexpectedly. - Who uses it: Developers who build long-running, multi-step processes that must finish even when services crash. - Why: Temporal is a durable execution platform. Its server runs units of application logic called Workflows so that they resume where they left off after crashes or outages, and it retries failed operations automatically. - Use case: An online shop's order process charges a card, reserves stock, books a courier and emails the customer, and any step can fail. Written as a Temporal Workflow, the process retries a failed step, carries on after a server restart without losing its place, and can wait days for a delivery confirmation. - Sources: https://github.com/temporalio/temporal, https://docs.temporal.io/ ### Traefik v3.7.16 - Page: https://readystack.dev/products/traefik - Image: readystack/traefik:v3.7.16-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/traefik/tags?name=v3.7.16-CE-ubuntu24.04-r1) - Pull: docker pull readystack/traefik:v3.7.16-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/traefik:v3.7.16-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/traefik#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/traefik/recipe (public in part; every file with a free account) - Upstream source: https://github.com/traefik/traefik/tree/af6d927c51191ae1df104aaf907793386b816c28 (commit af6d927c51191ae1df104aaf907793386b816c28) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (traefik) - Who uses it: Teams running services on container platforms such as Kubernetes who want routing that follows services as they change. - Why: Traefik is an HTTP reverse proxy and load balancer that reads your infrastructure, such as Kubernetes, and configures its routes automatically and dynamically, including HTTPS certificates. - Use case: A team deploys new microservices to Kubernetes every week. Each service declares its host name in its own configuration; Traefik notices it, starts routing traffic to it and obtains a certificate for it, with no edits to a central proxy configuration. - Sources: https://github.com/traefik/traefik ### Uptime Kuma 2.5.8 - Page: https://readystack.dev/products/uptimekuma - Image: readystack/uptimekuma:2.5.8-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/uptimekuma/tags?name=2.5.8-CE-ubuntu24.04-r2) - Pull: docker pull readystack/uptimekuma:2.5.8-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/uptimekuma:2.5.8-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/uptimekuma#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/uptimekuma/recipe (public in part; every file with a free account) - Upstream source: https://github.com/louislam/uptime-kuma/tree/0bd417b981d7dd4e7a0ecaa5afcd90c274d74eca (commit 0bd417b981d7dd4e7a0ecaa5afcd90c274d74eca) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (uptimekuma) - About: Uptime Kuma monitors service availability and sends alerts when outages occur. This self-contained application tracks status without requiring external databases or complex infrastructure. - Who uses it: Individuals, small teams and IT administrators who want to know when their websites and services go down. - Why: Uptime Kuma is an easy-to-use, self-hosted monitoring tool. It checks websites, ports, DNS records and containers at short intervals, sends notifications when something fails, and publishes status pages. - Use case: A small agency hosts websites for its clients. Uptime Kuma checks each site and its certificate, notifies the team by email or chat when one stops responding, and gives each client a status page for their own site. - Sources: https://github.com/louislam/uptime-kuma ### Valkey 9.1.3 - Page: https://readystack.dev/products/valkey - Image: readystack/valkey:9.1.3-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/valkey/tags?name=9.1.3-CE-ubuntu24.04-r1) - Pull: docker pull readystack/valkey:9.1.3-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/valkey:9.1.3-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/valkey#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/valkey/recipe (public in part; every file with a free account) - Upstream source: https://github.com/valkey-io/valkey/tree/29173b67508b2de4c0f0ed551f3b47cf19fc3ca8 (commit 29173b67508b2de4c0f0ed551f3b47cf19fc3ca8) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (valkey) - About: Valkey provides a Redis-compatible in-memory data store for high-speed caching and session management. It offers reliable persistence to disk, ensuring your application data remains safe without requiring external dependencies. - Who uses it: Developers who need a key-value data store for caching, message queues, sessions and other real-time workloads. - Why: Valkey is an open-source key-value datastore and data structure server, used for caching, message queues and as a primary database, with a plugin system for new data structures. - Use case: A web application computes the same expensive results again and again. It stores each result in Valkey under a key with a timeout; later requests read the stored value instead of recomputing it, and Valkey deletes the entries when their timeout expires. - Sources: https://github.com/valkey-io/valkey, https://valkey.io/, https://valkey.io/commands/expire/ ### Vaultwarden 1.37.4 - Page: https://readystack.dev/products/vaultwarden - Image: readystack/vaultwarden:1.37.4-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/vaultwarden/tags?name=1.37.4-CE-ubuntu24.04-r4) - Pull: docker pull readystack/vaultwarden:1.37.4-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/vaultwarden:1.37.4-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/vaultwarden#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/vaultwarden/recipe (public in part; every file with a free account) - Upstream source: https://github.com/dani-garcia/vaultwarden/tree/7c188967e7a467b19b2757bc3326f9cf3ccae327 (commit 7c188967e7a467b19b2757bc3326f9cf3ccae327) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (vaultwarden) - About: Vaultwarden provides a self-hosted password manager compatible with Bitwarden clients, allowing you to securely store and sync credentials across devices. It eliminates vendor lock-in by running entirely on your own infrastructure with no external database dependencies. - Who uses it: Families, small teams and self-hosters who want a password manager whose server they run themselves. - Why: Vaultwarden is a lightweight, self-hosted password manager server. It implements another password manager's client API, so that manager's existing browser, desktop and mobile apps connect to it. - Use case: A small office wants shared passwords out of spreadsheets. On Vaultwarden each person has a personal vault, the team shares logins through an organisation with collections, and everyone signs in with two-factor authentication from the apps they already use. - Sources: https://github.com/dani-garcia/vaultwarden ### VictoriaMetrics v1.155.0 - Page: https://readystack.dev/products/victoriametrics - Image: readystack/victoriametrics:v1.155.0-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/victoriametrics/tags?name=v1.155.0-CE-ubuntu24.04-r1) - Pull: docker pull readystack/victoriametrics:v1.155.0-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/victoriametrics:v1.155.0-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/victoriametrics#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/victoriametrics/recipe (public in part; every file with a free account) - Upstream source: https://github.com/VictoriaMetrics/VictoriaMetrics/tree/3fec2f72414d00d1acda807c8818d7af90cc966d (commit 3fec2f72414d00d1acda807c8818d7af90cc966d) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (victoriametrics) - Who uses it: Operations and SRE teams who store and query large volumes of monitoring metrics. - Why: VictoriaMetrics is a time series database and monitoring solution, open source in both its single-node and cluster versions, with its own query language, MetricsQL. - Use case: A company's monitoring has outgrown the local storage of its servers. Agents send metrics to a VictoriaMetrics cluster, which keeps them for long-term storage; dashboards query them with MetricsQL, and alert rules run against the same data. - Sources: https://github.com/VictoriaMetrics/VictoriaMetrics, https://docs.victoriametrics.com/ ### virt-api v1.9.1 - Page: https://readystack.dev/products/virtapi - Image: readystack/virtapi:v1.9.1-CE-debian12-r1 (https://hub.docker.com/r/readystack/virtapi/tags?name=v1.9.1-CE-debian12-r1) - Pull: docker pull readystack/virtapi:v1.9.1-CE-debian12-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/virtapi:v1.9.1-CE-debian12-r1 - Hermetic Build Kit: https://readystack.dev/products/virtapi#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/virtapi/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubevirt/kubevirt/tree/c3d19093f9c7b843b3879b18dc088911c081c39e (commit c3d19093f9c7b843b3879b18dc088911c081c39e) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (1001) - Who uses it: Kubernetes cluster administrators who run virtual machines in their clusters with KubeVirt. - Why: virt-api is KubeVirt's API server and the entry point for virtualisation requests. It fills in defaults for virtual machine definitions and validates them. - Use case: When a user creates or changes a virtual machine in a cluster running KubeVirt, the request passes through virt-api, which applies default settings and rejects invalid definitions before they are stored as Kubernetes resources. - Sources: https://github.com/kubevirt/kubevirt/blob/main/docs/components.md, https://github.com/kubevirt/kubevirt ### virt-controller v1.9.1 - Page: https://readystack.dev/products/virtcontroller - Image: readystack/virtcontroller:v1.9.1-CE-debian12-r1 (https://hub.docker.com/r/readystack/virtcontroller/tags?name=v1.9.1-CE-debian12-r1) - Pull: docker pull readystack/virtcontroller:v1.9.1-CE-debian12-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/virtcontroller:v1.9.1-CE-debian12-r1 - Hermetic Build Kit: https://readystack.dev/products/virtcontroller#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/virtcontroller/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubevirt/kubevirt/tree/c3d19093f9c7b843b3879b18dc088911c081c39e (commit c3d19093f9c7b843b3879b18dc088911c081c39e) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (1001) - Who uses it: Kubernetes cluster administrators who run virtual machines in their clusters with KubeVirt. - Why: virt-controller holds KubeVirt's cluster-wide virtualisation logic. It watches virtual machine instances and creates and manages the pod that each one runs in. - Use case: When a user starts a virtual machine, virt-controller sees the new instance and creates a pod for it; Kubernetes schedules that pod onto a node, and virt-controller records the node so the virt-handler there can start the VM. - Sources: https://github.com/kubevirt/kubevirt/blob/main/docs/components.md, https://github.com/kubevirt/kubevirt ### virt-exportproxy v1.9.1 - Page: https://readystack.dev/products/virtexportproxy - Image: readystack/virtexportproxy:v1.9.1-CE-debian12-r1 (https://hub.docker.com/r/readystack/virtexportproxy/tags?name=v1.9.1-CE-debian12-r1) - Pull: docker pull readystack/virtexportproxy:v1.9.1-CE-debian12-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/virtexportproxy:v1.9.1-CE-debian12-r1 - Hermetic Build Kit: https://readystack.dev/products/virtexportproxy#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/virtexportproxy/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubevirt/kubevirt/tree/c3d19093f9c7b843b3879b18dc088911c081c39e (commit c3d19093f9c7b843b3879b18dc088911c081c39e) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (1001) - Who uses it: Cluster administrators who move KubeVirt virtual machines and their disks out of a cluster. - Why: virt-exportproxy is KubeVirt's export proxy. Virtual machine exports are downloaded through it, a dedicated server, so large disk transfers do not load the Kubernetes API server. - Use case: An administrator wants to move a virtual machine into another cluster or system. They create an export for the VM, then download its disk images through the export proxy, which can be reached from outside the cluster through an Ingress or a NodePort service. - Sources: https://kubevirt.io/user-guide/storage/export_api/, https://github.com/kubevirt/kubevirt ### virt-operator v1.9.1 - Page: https://readystack.dev/products/virtoperator - Image: readystack/virtoperator:v1.9.1-CE-debian12-r1 (https://hub.docker.com/r/readystack/virtoperator/tags?name=v1.9.1-CE-debian12-r1) - Pull: docker pull readystack/virtoperator:v1.9.1-CE-debian12-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/virtoperator:v1.9.1-CE-debian12-r1 - Hermetic Build Kit: https://readystack.dev/products/virtoperator#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/virtoperator/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubevirt/kubevirt/tree/c3d19093f9c7b843b3879b18dc088911c081c39e (commit c3d19093f9c7b843b3879b18dc088911c081c39e) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (1001) - Who uses it: Kubernetes cluster administrators who run virtual machines in their clusters with KubeVirt. - Why: virt-operator installs KubeVirt and manages the lifecycle of its core components: it deploys them when a KubeVirt resource is created and rolls out new versions when that resource or the operator is updated. - Use case: An administrator adds virtual machine support to a cluster by applying the operator and then a KubeVirt resource, and virt-operator deploys the rest of KubeVirt. Later, an upgrade is a change to that resource, and virt-operator rolls out the new version while existing virtual machines keep running. - Sources: https://kubevirt.io/user-guide/cluster_admin/installation/, https://kubevirt.io/user-guide/cluster_admin/updating_and_deletion/, https://github.com/kubevirt/kubevirt/blob/main/docs/components.md ### virtctl v1.9.1 - Page: https://readystack.dev/products/virtctl - Image: readystack/virtctl:v1.9.1-CE-scratch-r1 (https://hub.docker.com/r/readystack/virtctl/tags?name=v1.9.1-CE-scratch-r1) - Pull: docker pull readystack/virtctl:v1.9.1-CE-scratch-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/virtctl:v1.9.1-CE-scratch-r1 - Hermetic Build Kit: https://readystack.dev/products/virtctl#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/virtctl/recipe (public in part; every file with a free account) - Upstream source: https://github.com/kubevirt/kubevirt/tree/c3d19093f9c7b843b3879b18dc088911c081c39e (commit c3d19093f9c7b843b3879b18dc088911c081c39e) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-29 with the network off - Runs as: Non-root (65532) - Who uses it: Administrators and users who manage KubeVirt virtual machines from the command line. - Why: virtctl is KubeVirt's command-line client. It adds what plain kubectl cannot do, such as serial and graphical console access, and shortcuts to start, stop and migrate virtual machines and upload disk images. - Use case: An administrator's virtual machine stops answering on the network. With virtctl they open its serial console to see what the guest is doing, restart it if needed, and live-migrate it to another node before that node goes down for maintenance. - Sources: https://kubevirt.io/user-guide/user_workloads/virtctl_client_tool/, https://github.com/kubevirt/kubevirt ### Wiki.js 3.0.0-beta.685 - Page: https://readystack.dev/products/wikijs - Image: readystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r3 (https://hub.docker.com/r/readystack/wikijs/tags?name=3.0.0-beta.685-CE-ubuntu24.04-r3) - Pull: docker pull readystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r3 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/wikijs:3.0.0-beta.685-CE-ubuntu24.04-r3 - Hermetic Build Kit: https://readystack.dev/products/wikijs#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/wikijs/recipe (public in part; every file with a free account) - Upstream source: https://github.com/requarks/wiki/tree/a53dea81734a29428729b7043f4aaabf57e41de1 (commit a53dea81734a29428729b7043f4aaabf57e41de1) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (wiki) - About: Wiki.js delivers a modern, collaborative knowledge base for teams, allowing you to create and organize documentation through an intuitive web interface. It requires an external database for persistent storage, ensuring your content remains secure and accessible across your organization. - Who uses it: Teams and organisations that want a self-hosted wiki for their documentation, written in Markdown or a visual editor. - Why: Wiki.js is open-source wiki software with Markdown, visual and HTML editors, version history on every page, search, and sign-in through local accounts or company systems such as LDAP, SAML and OpenID Connect. - Use case: An engineering team writes its documentation in Markdown, while the support team prefers a visual editor. In Wiki.js both edit the same wiki, every change is tracked so a page can be compared or reverted, and staff sign in with their company accounts. - Sources: https://github.com/requarks/wiki, https://js.wiki/ ### WireGuard 0.0.20250522 - Page: https://readystack.dev/products/wireguard - Image: readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/wireguard/tags?name=0.0.20250522-CE-ubuntu24.04-r1) - Pull: docker pull readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/wireguard#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/wireguard/recipe (public in part; every file with a free account) - Upstream source: https://git.zx2c4.com/wireguard-go (commit f333402bd9cbe0f3eeb02507bd14e23d7d639280) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (wireguard) - Who uses it: Network administrators and individuals who need a simple, secure VPN between servers, sites or devices. - Why: WireGuard is a simple, modern VPN that uses current cryptography. Peers authenticate each other by exchanging public keys, much like SSH keys, and the tunnel can roam between IP addresses. - Use case: A small company needs staff laptops to reach servers on its office network. A WireGuard endpoint at the office holds each laptop's public key and allowed addresses; each laptop connects with a short configuration file, and the tunnel keeps working as the laptop moves between networks. - Sources: https://www.wireguard.com/, https://git.zx2c4.com/wireguard-go/about/ ### Woodpecker v3.19.0 - Page: https://readystack.dev/products/woodpecker - Image: readystack/woodpecker:v3.19.0-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/woodpecker/tags?name=v3.19.0-CE-ubuntu24.04-r2) - Pull: docker pull readystack/woodpecker:v3.19.0-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/woodpecker:v3.19.0-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/woodpecker#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/woodpecker/recipe (public in part; every file with a free account) - Upstream source: https://github.com/woodpecker-ci/woodpecker/tree/9f5568c20a1f7195d23c4194c49d53bd2580be41 (commit 9f5568c20a1f7195d23c4194c49d53bd2580be41) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (woodpecker) - About: Woodpecker automates software delivery by connecting your code repository to independent agents that build and test your projects. This self-hosted platform gives you full control over your continuous integration workflows without relying on external services. - Who uses it: Development teams who want a lightweight, self-hosted CI/CD engine for the repositories on their Git server. - Why: Woodpecker is a simple CI/CD engine. A workflow file in each repository lists the steps to build, test and deploy the code, and Woodpecker runs them on every change; plugins add common tasks. - Use case: A small team hosts its own Git server and wants tests on every push. With Woodpecker connected to it, each repository's workflow file runs on every change: the code is tested, the application is built, and it is deployed when the main branch passes. - Sources: https://github.com/woodpecker-ci/woodpecker, https://woodpecker-ci.org/docs/intro, https://woodpecker-ci.org/docs/usage/intro, https://woodpecker-ci.org/docs/usage/workflow-syntax ### WordPress 7.1.3 - Page: https://readystack.dev/products/wordpress - Image: readystack/wordpress:7.1.3-CE-ubuntu24.04-r4 (https://hub.docker.com/r/readystack/wordpress/tags?name=7.1.3-CE-ubuntu24.04-r4) - Pull: docker pull readystack/wordpress:7.1.3-CE-ubuntu24.04-r4 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/wordpress:7.1.3-CE-ubuntu24.04-r4 - Hermetic Build Kit: https://readystack.dev/products/wordpress#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/wordpress/recipe (public in part; every file with a free account) - Upstream source: https://github.com/WordPress/WordPress/tree/fc9832bef919c2a08541248db23af90d14ffb082 (commit fc9832bef919c2a08541248db23af90d14ffb082) - Original grade: A (score 100 of 100), pushed 2026-10-27, scanned 2026-10-27 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (www-data) - Who uses it: Bloggers, small businesses, publishers and organisations who build and run websites. - Why: WordPress is open-source publishing software for websites and blogs. Write and schedule posts and pages, manage media and users with roles, and extend the site with themes and plugins. - Use case: A local business wants a website its staff can update without a developer. With WordPress they pick a theme, the owner writes and schedules news posts, an editor manages the pages and images, and plugins add a calendar and spam protection for comments. - Sources: https://wordpress.org/about/, https://wordpress.org/about/features/, https://github.com/WordPress/WordPress ### Zabbix 7.4.16 - Page: https://readystack.dev/products/zabbix - Image: readystack/zabbix:7.4.16-CE-ubuntu24.04-r2 (https://hub.docker.com/r/readystack/zabbix/tags?name=7.4.16-CE-ubuntu24.04-r2) - Pull: docker pull readystack/zabbix:7.4.16-CE-ubuntu24.04-r2 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/zabbix:7.4.16-CE-ubuntu24.04-r2 - Hermetic Build Kit: https://readystack.dev/products/zabbix#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/zabbix/recipe (public in part; every file with a free account) - Upstream source: https://github.com/zabbix/zabbix/tree/b90dda2ec5983a92c9671550b5e32947cf241cd2 (commit b90dda2ec5983a92c9671550b5e32947cf241cd2) - Original grade: A (score 100 of 100), pushed 2026-10-28, scanned 2026-10-28 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-27 with the network off - Runs as: Non-root (zabbix) - About: Zabbix monitors your infrastructure and applications to provide real-time visibility into system health. It alerts technical teams to potential issues before they impact business operations, ensuring reliable service delivery. - Who uses it: IT operations teams who monitor networks, servers, virtual machines, applications and cloud services. - Why: Zabbix is an open-source distributed monitoring solution. It discovers devices, collects metrics with or without agents, detects problems, sends alerts, and shows the data in graphs, maps and dashboards. - Use case: An IT team looks after switches, servers and databases across several offices. Zabbix discovers the devices, applies ready-made templates to monitor them, raises a problem when a disk fills or a link drops, and notifies the on-call administrator, including for offices behind firewalls. - Sources: https://github.com/zabbix/zabbix, https://www.zabbix.com/documentation/current/en/manual/introduction/about ### ZITADEL v4.20.0 - Page: https://readystack.dev/products/zitadel - Image: readystack/zitadel:v4.20.0-CE-ubuntu24.04-r1 (https://hub.docker.com/r/readystack/zitadel/tags?name=v4.20.0-CE-ubuntu24.04-r1) - Pull: docker pull readystack/zitadel:v4.20.0-CE-ubuntu24.04-r1 - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/zitadel:v4.20.0-CE-ubuntu24.04-r1 - Hermetic Build Kit: https://readystack.dev/products/zitadel#pp-kit (free to download for any registered account) - Source and build recipe: https://readystack.dev/products/zitadel/recipe (public in part; every file with a free account) - Upstream source: https://github.com/zitadel/zitadel/tree/8afa5dd37a8e723efb9eace8d09fd5c1cccef694 (commit 8afa5dd37a8e723efb9eace8d09fd5c1cccef694) - Original grade: A (score 100 of 100), pushed 2026-10-29, scanned 2026-10-29 - Current grade: A (score 100 of 100), scanned 2026-10-30 - Offline rebuild: Rebuilt bit-for-bit on 2026-10-28 with the network off - Runs as: Non-root (zitadel) - Who uses it: Developers building SaaS and business-to-business applications who need login, single sign-on and multi-tenancy. - Why: ZITADEL is an open-source identity and access management platform with single sign-on over OpenID Connect and SAML, multi-factor login and passkeys, multi-tenancy, an audit trail of all events, and APIs. - Use case: A software company sells its application to other businesses, each wanting its own branding and users. In ZITADEL each customer is an organisation with its own branded login and self-service user management, and the application signs everyone in through OpenID Connect. - Sources: https://github.com/zitadel/zitadel, https://zitadel.com/docs ## Platform stacks A platform stack is a matched set of ReadyStack releases installed together across several machines, with one install bundle that pins every image by digest. ### Kubernetes VM Stack v1.36.6-kubevirt1.9.1 - Page: https://readystack.dev/stacks/kubernetes-vm-stack - About: Virtual machines on a three-node, highly available Kubernetes cluster, from images ReadyStack built with the network off, each pinned by digest and pulled only from your own registry. - Bundle image: readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2 (linux/amd64 sha256:0268790dadac6fbc392784cb7f77f996526f4d1b6394bb30228d19ddaae062e9) - Verify: cosign verify --key https://readystack.dev/keys/cosign.pub readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2@sha256:0268790dadac6fbc392784cb7f77f996526f4d1b6394bb30228d19ddaae062e9 - Then: docker run --rm checks every file; docker create, docker cp :/kubernetesvmstack . copies the bundle out; follow kubernetesvmstack/install/README.md - Parts (current release in the catalogue; grade original → current on our scan): - Kubernetes Node v1.36.6: readystack/kubernetesnode:v1.36.6-CE-scratch-r1 (linux/amd64 sha256:0a264881a0b7357fb20767b0922661bf4ba4423b3e90e595195bf18748a8d79c); grade A → A; https://readystack.dev/products/kubernetesnode - kube-apiserver v1.36.6: readystack/kubeapiserver:v1.36.6-CE-ubuntu24.04-r1 (linux/amd64 sha256:49c4d7708668d7ab42ae0d1d3d584063f67ef87f2d746e21d6709288afdb997e); grade A → A; https://readystack.dev/products/kubeapiserver - kube-controller-manager v1.36.6: readystack/kubecontrollermanager:v1.36.6-CE-ubuntu24.04-r1 (linux/amd64 sha256:f832d6d6174e904cb86f178379571f02421cd5e056f112da12062aec8d2f93a2); grade A → A; https://readystack.dev/products/kubecontrollermanager - kube-scheduler v1.36.6: readystack/kubescheduler:v1.36.6-CE-ubuntu24.04-r1 (linux/amd64 sha256:db92258d58a8e98424edd20418624e6625c4360acedd4dd919443a3e538c9ef8); grade A → A; https://readystack.dev/products/kubescheduler - kube-proxy v1.36.6: readystack/kubeproxy:v1.36.6-CE-ubuntu24.04-r1 (linux/amd64 sha256:690fd8d24cd4ffbf70dbe1ba26ac48ce80a972d7183cf691948ff5ff8ca8d56c); grade A → A; https://readystack.dev/products/kubeproxy - pause 3.10.2: readystack/pause:3.10.2-CE-scratch-r1 (linux/amd64 sha256:6b74cfa71db2c51e1a21e3342402d3993573ea02a0c85063897eda87958dca26); grade A → A; https://readystack.dev/products/pause - CoreDNS v1.14.2: readystack/coredns:v1.14.2-CE-ubuntu24.04-r1 (linux/amd64 sha256:faf5d9691f306d7f318377a2db731aa843ef8ed23866e7c410cdbc001dda2c4b); grade A → A; https://readystack.dev/products/coredns - kube-vip v1.3.1: readystack/kubevip:v1.3.1-CE-ubuntu24.04-r1 (linux/amd64 sha256:74dd28c7b8af69cd7cf4684338b782d1fbf939a1dbfabeb1545d70b077cf934b); grade A → A; https://readystack.dev/products/kubevip - flannel v0.28.10: readystack/flannel:v0.28.10-CE-ubuntu24.04-r1 (linux/amd64 sha256:6d3fb1140502d71df92ae2b107532acaf809aa42a94e2e6b9eec291fab4b8856); grade A → A; https://readystack.dev/products/flannel - flannel CNI plugin v1.9.1-flannel3: readystack/flannelcniplugin:v1.9.1-flannel3-CE-ubuntu24.04-r1 (linux/amd64 sha256:4511acd7413d1e6fd78d3d712921d794cb820a3b62973512532d7b64f2cc4e8a); grade A → A; https://readystack.dev/products/flannelcniplugin - Multus CNI v4.3.1: readystack/multuscni:v4.3.1-CE-ubuntu24.04-r1 (linux/amd64 sha256:f90014221243e98cf21d56dc66e3f53bf386c1c1484a633e550dadf4e39f324e); grade A → A; https://readystack.dev/products/multuscni - virt-operator v1.9.1: readystack/virtoperator:v1.9.1-CE-debian12-r1 (linux/amd64 sha256:78de21c348d6b5c03db14e9b14e4fe02f947114771f8897f53c2f52bf435a0a6); grade A → A; https://readystack.dev/products/virtoperator - virt-api v1.9.1: readystack/virtapi:v1.9.1-CE-debian12-r1 (linux/amd64 sha256:1b50959eea78ae4db3a6037b90943ada86b9cb5426bb4790525316087d0ff582); grade A → A; https://readystack.dev/products/virtapi - virt-controller v1.9.1: readystack/virtcontroller:v1.9.1-CE-debian12-r1 (linux/amd64 sha256:4e9192b84b55aa401f992f0337ac4a76e79d25ff2519e803274a3c353b01ad12); grade A → A; https://readystack.dev/products/virtcontroller - virt-exportproxy v1.9.1: readystack/virtexportproxy:v1.9.1-CE-debian12-r1 (linux/amd64 sha256:3bb06b5880899bf2955da20fb6c47810f0a863a9057c0c9ec13f61a3a624322b); grade A → A; https://readystack.dev/products/virtexportproxy - readystack/virthandler:v1.9.1-CE-centos9-r1: published, not listed in the catalogue; grade F → F. Published and signed, but not listed: it scores below A on our scan. KubeVirt builds virt-handler on its own CentOS Stream 9 package set, which carries high vulnerabilities that CentOS Stream has not fixed yet. Its Docker Hub page gives the grade and every deduction. https://hub.docker.com/r/readystack/virthandler - readystack/virtlauncher:v1.9.1-CE-centos9-r1: published, not listed in the catalogue; grade F → F. Published and signed, but not listed: it scores below A on our scan. KubeVirt builds virt-launcher, QEMU and libvirt included, on its own CentOS Stream 9 package set, which carries high vulnerabilities that CentOS Stream has not fixed yet. Its Docker Hub page gives the grade and every deduction. https://hub.docker.com/r/readystack/virtlauncher - virtctl v1.9.1: readystack/virtctl:v1.9.1-CE-scratch-r1 (linux/amd64 sha256:634431da66d601627ffc0cddd0e41d02678ff5c1a2f6407661ae9f8a85091501); grade A → A; https://readystack.dev/products/virtctl - etcd v3.7.3: readystack/etcd:v3.7.3-CE-ubuntu24.04-r1 (linux/amd64 sha256:b21b8089f1957b35bfaf54647f871c1e9e56d36d20af32a2fdb9b2b6483d62f6); grade A → A; https://readystack.dev/products/etcd - Distribution Registry v3.1.2: readystack/registry:v3.1.2-CE-ubuntu24.04-r5 (linux/amd64 sha256:9b7a9955779cf093257a24546a860c35f627315956b12a93b9a03f013dffc449); grade A → A; https://readystack.dev/products/registry - Kubernetes VM Stack v1.36.6-kubevirt1.9.1: readystack/kubernetesvmstack:v1.36.6-kubevirt1.9.1-CE-scratch-r2 (linux/amd64 sha256:0268790dadac6fbc392784cb7f77f996526f4d1b6394bb30228d19ddaae062e9); grade A → A; https://readystack.dev/products/kubernetesvmstack - Tested before release: Acceptance run, 2026-10-29, 11:03–11:55 UTC: passed. Every image was pulled from Docker Hub at its published digest into a local registry on the test network. The mirror copies an image only when its linux/amd64 digest is the one the bundle lists. cosign verified 60 of 60 signatures against ReadyStack's release key: the 30 names mirrored into the local registry, each by tag and by digest. The host-side kubernetesnode and virtctl releases verified too. Every mirrored image, and both host-side releases, carried an SPDX SBOM and SLSA v1 provenance. The test nodes could not reach the internet: from each node, HTTPS to public IP addresses was refused, checked at the start and again after KubeVirt was installed. On every node, every image ran at exactly its published digest, with none failing the check. No image defaulted to root: uid 0 came only where the bundle's files set it. Pods reached each other across the nodes and through a Service, and the Multus bridge gave a Pod a second interface. Failover: the control-plane node holding the virtual IP was switched off. The API answered on the virtual IP again after 17 s, from another node, and a write was accepted. Started again, the node was Ready after 68 s. KubeVirt became Available from the published images. A CirrOS VM booted from a static local disk ran under KVM, gave a console login prompt through the published virtctl, and took an address on the hosts' LAN. Two failures in the test's own scripts were fixed during the run. The record keeps both, and neither was a defect of a published image. - Known limits: A VM on a local volume is pinned to its node: it cannot live-migrate, and it stops while that node is down. Kubernetes 1.37 waits for a KubeVirt release that supports it. KubeVirt 1.9 supports Kubernetes 1.34 to 1.36, so we hold the stack on the 1.36 line. containerd reads the registry credential from its deprecated registry.configs setting. The runbook says why, and the stack keeps containerd on a release that still reads it. The OCI licences labels of the pause (https://readystack.dev/products/pause) and kubernetesnode (https://readystack.dev/products/kubernetesnode) images understate their licences: they leave out glibc, which is linked into them statically and is LGPL-2.1-or-later. Their Docker Hub pages and SBOMs say so, and each image's next revision corrects the label. virt-handler and virt-launcher are published and signed but not listed, because they score below A on our scan (see the table above). readystack/registry's health check probes 127.0.0.1, so with the registry bound to another address and TLS on, Docker reports it unhealthy while it serves. Built for x86-64 (linux/amd64) only. - Ask for another stack: https://github.com/ReadyStackFree/readystack/issues/new?template=request.yml&title=Platform%20stack%3A%20 (or email contact@readystack.dev) with the platform, its components and the machines