$ show rtvkiz/minimal
This repository is a sophisticated build factory for producing hardened, minimal container images. It defines over 100 image recipes (melange.yaml + apko.yaml) covering runtimes, databases, monitoring tools, security scanners, and Kubernetes infrastructure. Each image is built from source or from Wolfi packages, assembled into a distroless (shell-less), non-root OCI image, signed with Cosign, and attested with SLSA v1.0 provenance and SPDX SBOM. The entire pipeline is orchestrated via GitHub Actions: automated version bumps (daily), transitive CVE patching (for Go, Java, Ruby, Rust), vulnerability scanning with Grype, and VEX management. A companion Astro-based static site (minimalcontainers.com) catalogs the images, displays CVE comparisons against competing registries (Minimus, Chainguard, Bitnami), and provides documentation. The repository is not an end-user application but a highly engineered CI/CD system for producing and publishing container images as artifacts.
The LLM identified 3 files worth highlighting for reuse:
A self-contained shell script that derives a ladder of Docker tags from a semver version (e.g., v3.21.4 produces tags :3, :3.21, :3.21.4). It handles pre-release identifiers, sorts tags, and outputs a JSON array. Could be reused by any project needing a rolling tag scheme without external dependencies.
An automated CVE patching script that uses Grype and Syft to scan images, then applies fixes for Go, Ruby (bundler), Rust (cargo), and Maven dependencies. It replaces vulnerable jars/libraries by downloading patched versions from upstream sources with SHA256 verification. Implements a 'sticky merge' strategy to prevent oscillation and supports multiple ecosystems in one workflow. Reusable as a post-build vulnerability remediation step.
A script that reconciles APK provenance entries against Wolfi's advisory feed to filter out false-positive CVE matches caused by package name collisions. It cross-references the Wolfi APKINDEX, identifies entries that do not belong to the actual image, and generates a filtered list. Essential for accurate vulnerability dashboards and reusable in any Wolfi-based container build pipeline.