cd ../projects
project 01 / 10

QuenchWorks — 0-CVE Hardened Images & Helm Charts

A from-scratch, security-first replacement for the Bitnami catalog: container images and Helm charts built entirely from source on Wolfi, hardened under a strict 0-CVE build gate, cryptographically signed, and pinned by digest. Free, independent, and fully self-hostable.

10 tech · 7 features · live

// key features

  • 150+ container images built from source on Wolfi, gated to zero fixable CVEs by comprehensive-mode Trivy
  • 120+ production Helm charts on a shared quench-common library, each pinned to its image by digest
  • Every image cosign-signed (keyless) with SPDX SBOM and SLSA build-provenance attestations
  • ArtifactHub verified-publisher organization with per-chart metadata
  • Multi-arch (amd64 + arm64), nonroot, read-only root filesystem by default
  • Nightly Trivy rescans with an automatic self-heal rebuild loop as upstream ships fixes
  • Free and independent — no subscription, no registry pull limits, no vendor lock-in

// discussion

next project Mathematics - Formula Reference