Distroless·Non-root·Free & open source
Distroless, non-root base images for Java, Python, Node, Go, and Rust — plus nginx and Redis. musl by default for a smaller libc; glibc one tag away. No shell, no package manager, no root — almost nothing for an attacker to land on, and far less to patch.
# build your static binary where the toolchain lives…
FROM golang:1-bookworm AS build
COPY . .
RUN CGO_ENABLED=0 go build -o /out/app .
# …then ship just the binary: non-root, no shell, no OS
FROM ghcr.io/mathiasror/varde-go:latest
COPY --from=build /out/app /app/appThe catalog
Each image is just the runtime — or, for a compiled binary, just its libc: non-root, no shell, musl by default. A scannable SBOM per image, multi-arch, on GitHub Container Registry.
JVM apps (Java / Kotlin). Prebuilt headless Temurin JRE — drop a fat JAR at /app/app.jar. *17 is glibc-only.
FROM ghcr.io/mathiasror/varde-jre:21
Python apps. The CPython interpreter only — no pip, no shell. COPY your resolved deps in.
FROM ghcr.io/mathiasror/varde-python:3.13
Node.js apps. The node runtime only — no npm. COPY node_modules plus your code.
FROM ghcr.io/mathiasror/varde-node:24
PHP apps. The interpreter with the stock extension set plus php-fpm — no composer, no pecl. COPY vendor/ plus your code.
FROM ghcr.io/mathiasror/varde-php:8.5
Static sites, non-root on :8080. COPY site/ /app/ and serve — no root, no shell.
FROM ghcr.io/mathiasror/varde-nginx:latest
The Redis server, distroless and non-root. Run as-is or drop in a redis.conf.
FROM ghcr.io/mathiasror/varde-redis:latest
The PostgreSQL server, distroless and non-root. One explicit initdb against a volume at /app, then it runs as-is. Ships a minimal /bin/sh (ash) — initdb requires one; the sole exception to no-shell.
FROM ghcr.io/mathiasror/varde-postgres:18
MySQL 8.4 LTS, distroless and non-root. Native no-shell initialization — one --initialize-insecure run, then serve. glibc-only.
FROM ghcr.io/mathiasror/varde-mysql:8.4
RabbitMQ with a shell-free Erlang boot — the VM is exec'd directly; epmd and the escript CLI work without a single script.
FROM ghcr.io/mathiasror/varde-rabbitmq:latest
The Memcached server, distroless and non-root. Run as-is or pass flags via CMD — no config file needed.
FROM ghcr.io/mathiasror/varde-memcached:latest
Any compiled binary at /app/app: static (Go CGO_ENABLED=0), glibc (a default cargo build), or musl. varde-go & varde-rust alias the first two.
FROM ghcr.io/mathiasror/varde-static:latest
-glibc tag to opt in:21-musl-arm64)Why varde
A varde — the Norwegian cairn, a stack of stones that marks a trail — carries only the stones that mark the way. These images carry only what your app needs to run.
No shell, no package manager, no busybox, no coreutils. Just the runtime — nothing for an attacker to pivot through.
Every container runs as uid/gid 1000:1000 in a /app it owns. No root user is even present.
Native linux/amd64 and linux/arm64, selectable by tag (e.g. :21-musl-arm64). Same image, your architecture.
A distroless image has no OS package DB — so a Nix-closure CycloneDX SBOM covers system packages and the runtime. Scan it with grype.
Reproducible builds from a committed lockfile. A weekly lock-bump commit flows CVE fixes through — every image traces to a commit.
Bring one real artifact — a fat JAR, a binary, code plus its deps — and add two lines of Dockerfile. The entrypoint runs it directly.
Usage
Build your artifact in a stage that has the tooling, then COPY it onto varde. There's no shell, so the entrypoint runs your app directly.
# build stage: Gradle bootJar -> one self-contained fat jar
FROM gradle:8.14-jdk21 AS build
WORKDIR /home/gradle/src
COPY --chown=gradle:gradle . .
RUN gradle bootJar --no-daemon
FROM ghcr.io/mathiasror/varde-jre:21
# base ENTRYPOINT is java -jar /app/app.jar — just place the jar
COPY --from=build /home/gradle/src/build/libs/app.jar /app/app.jar# deps stage: alpine = musl, matching the default musl runtime
FROM python:3.13-alpine AS deps
WORKDIR /build
COPY requirements.txt .
RUN pip install --no-cache-dir --target=/app/site-packages -r requirements.txt
FROM ghcr.io/mathiasror/varde-python:3.13
COPY --from=deps /app/site-packages /app/site-packages
COPY main.py /app/main.py
# no shell to "activate a venv" — put the deps on the import path
ENV PYTHONPATH=/app/site-packages# deps stage: alpine = musl, so native addons match the runtime
FROM node:24-alpine AS deps
WORKDIR /build
COPY package*.json ./
RUN npm ci --omit=dev
FROM ghcr.io/mathiasror/varde-node:24
COPY --from=deps /build/node_modules /app/node_modules
COPY src/ /app/src/
# no npm start — point CMD straight at a real file
CMD ["/app/src/server.js"]# build stage: CGO_ENABLED=0 -> a fully static binary
FROM golang:1-bookworm AS build
WORKDIR /src
COPY . .
RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /out/app .
FROM ghcr.io/mathiasror/varde-static:latest
# base ENTRYPOINT is /app/app — just drop the binary in
COPY --from=build /out/app /app/app# build stage: a default cargo build links glibc -> varde-glibc
FROM rust:1-bookworm AS build
WORKDIR /src
COPY . .
RUN cargo build --release --locked
FROM ghcr.io/mathiasror/varde-glibc:latest
# base ENTRYPOINT is /app/app — just drop the binary in
COPY --from=build /src/target/release/app /app/appFROM ghcr.io/mathiasror/varde-nginx:latest
COPY site/ /app/
# serves /app on :8080, non-rootFROM ghcr.io/mathiasror/varde-redis:latest
COPY redis.conf /app/redis.conf
CMD ["/app/redis.conf"]Built with Nix
Nix builds each image from an exact dependency closure. That same closure becomes the SBOM — so what grype scans is precisely what's in the image, down to glibc and zlib.
Nix pins the exact runtime and system libraries — and only those.
sbomnix emits a CycloneDX SBOM with CPEs from that closure.
System packages and runtime are scannable — not just your app deps.
Free & open
A hardened base image shouldn't come with a sales call, a personal access token, and a per-seat licence. varde is public and yours: read the entire Nix build, scan the SBOM, and docker pull without an account.
Free & open source
docker pull — no token, no loginFree* terms apply