core
Minimal base images on Wolfi (opens in new tab),
Alpine (opens in new tab), and Ubuntu (opens in new tab) for building
applications that run as an unprivileged user. Each holds CA certificates, tzdata,
curl, bash, and a nonroot user, and nothing else. core is also the base of
devbox.
- Images
- GHCR
ghcr.io/hambn/core - Docker Hub
docker.io/hambn/core
- GHCR
Images
wolfi: Wolfi, a glibc distribution built for containers.docker buildbuilds this variant by default.- Base:
chainguard/wolfi-base - Tags:
wolfi
- Base:
alpine: Alpine 3.24.- Base:
alpine:3.24 - Tags:
alpine
- Base:
ubuntu: Ubuntu 24.04, for software that needs glibc and apt.latestpoints here.- Base:
ubuntu:24.04 - Tags:
ubuntu,latest
- Base:
Pull ghcr.io/hambn/core:<tag> or docker.io/hambn/core:<tag>. All tags move when the
image is rebuilt; pin a digest to keep one build. The Dockerfile (opens in new tab) pins
each upstream base by digest and holds the date that forces an OS package refresh.
Hardening
- Runs as
nonroot(UID and GID 65532) in/home/nonroot. The default command isbash. - Has no
sudo, and the build clears every setuid and setgid bit. - Removes documentation, man pages, and package caches. The package manager stays, so
a derived image can install packages as
USER root. - On Ubuntu, removes the stock
ubuntuaccount (UID 1000).
Use cases
- Throwaway shell or base for your own image with Docker: run curl
and bash in a disposable container, or build
FROM ghcr.io/hambn/core:wolfi. - Locked-down read-only shell service with Docker Compose.