cd ../projects
project 01 / 10
QuenchWorks — 0-CVE Hardened Images & Helm Charts
A from-scratch, security-first replacement for the Bitnami catalog: container images and Helm charts built entirely from source on Wolfi, hardened under a strict 0-CVE build gate, cryptographically signed, and pinned by digest. Free, independent, and fully self-hostable.
// key features
- 150+ container images built from source on Wolfi, gated to zero fixable CVEs by comprehensive-mode Trivy
- 120+ production Helm charts on a shared quench-common library, each pinned to its image by digest
- Every image cosign-signed (keyless) with SPDX SBOM and SLSA build-provenance attestations
- ArtifactHub verified-publisher organization with per-chart metadata
- Multi-arch (amd64 + arm64), nonroot, read-only root filesystem by default
- Nightly Trivy rescans with an automatic self-heal rebuild loop as upstream ships fixes
- Free and independent — no subscription, no registry pull limits, no vendor lock-in
// discussion