kenzman/ns-wolfi-go-runtime repository overview

⁠Secure Wolfi-GO Runtime Base Image

This is a minimal, hardened, multi-architecture Go runtime built on Wolfi. Unlike ns-wolfi-go (which contains the full Go toolchain for building), this image is designed for production runtime only — no compiler, no toolchain.

⁠Key Features

• Minimal Attack Surface: Contains only wolfi-base and CA certificates
• Multi-Arch: Native support for linux/amd64 and linux/arm64
• Supply Chain Security: Keylessly signed with Cosign

⁠Usage

Use in a multi-stage Dockerfile — compile with the toolchain image, run with this:

# Build stage
FROM kenzman/ns-wolfi-go:latest AS builder
WORKDIR /app
COPY . .
RUN go build -o myapp .

# Runtime stage
FROM kenzman/ns-wolfi-go-runtime:latest
COPY --from=builder /app/myapp /myapp
ENTRYPOINT ["/myapp"]

⁠Security Verification

cosign verify \
  --certificate-identity-regexp "https://github.com/Ekene95/secops-base-images/.*" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  kenzman/ns-wolfi-go-runtime:latest

⁠Related Images