Containers

A Collection of Container Images Optimized for Kubernetes

Welcome to my container images, if looking for a container start by browsing the container packages.

Mission statement

The goal of this project is to support containers for various applications, while following the best practices including:

• Semantic versioning
• Multiple architectures
• Security best practices
  • Rootless PID 1
  • Restricted Pod Security Standards
  • Read-Only Root Filesystem
  • Mount secrets as files
    • By default all files in /secrets will be passed to underlying process (i.e. /secrets/MY_SECRET contents will be passed as MY_SECRET env)
    • Also any env ending in _FILE will have underlying file passed (i.e. MY_SECRET_FILE=/path/file will result in MY_SECRET=<contents of /path/file>)
• Consistent behavior for all images
  • Use original image environment variables as closely as possible
  • Logging to stdout
  • One process per container
  • Consistent paths
    • All configuration data (files, sqlite databases, caches etc.) should live in /config endpoint
    • All assets (photos, movies, Linux ISOs) should live in /data endpoint
    • Writable /tmp

Very few containers (like proxmox-backup-server) are basically full operating systems, squished into container format. These ones need root and rw permissions to work properly. They will be marked accordingly in Available Images table.

Global env variables

These environment variables are universally available across all images:

ENV	Default	Description
DEBUG_OS	""	When set to any value, implies set -x
ENVDIR_DIRECTORY	/secrets	Directory to pick env variables from
SKIP_FILE_SECRETS_EXPANSION	""	When set, all _FILE envs won't be expanded and checked

Tag immutability

The containers built here do not use immutable tags, as least not in the more common way you have seen from linuxserver.io or Bitnami.

A similar approach applies here, but instead of appending a -ls69 or -r420 prefix to the tag, instead the sha256 digest of the image is used. While this is not as pretty it is just as functional in making the images immutable.

Container	Immutable
ghcr.io/deedee-ops/paperless-ngx:latest	❌
ghcr.io/deedee-ops/paperless-ngx:1.17.4	❌
ghcr.io/deedee-ops/paperless-ngx:latest@sha256:613c...	✅
ghcr.io/deedee-ops/paperless-ngx:1.17.4@sha256:613c...	✅

If pinning an image to the sha256 digest, tools like Renovate support updating the container on a digest or application version change.

Available Images

Each Image will be built with a latest tag, along with tags specific to it's version. Available Images Below

Container	Root/RW	Channel	Image	Latest Tags
authelia		stable	ghcr.io/deedee-ops/authelia
bazarr		stable	ghcr.io/deedee-ops/bazarr
csp-exporter		stable	ghcr.io/deedee-ops/csp-exporter
firefly-iii		stable	ghcr.io/deedee-ops/firefly-iii
firefoxsync		stable	ghcr.io/deedee-ops/firefoxsync
gokapi		stable	ghcr.io/deedee-ops/gokapi
gose		stable	ghcr.io/deedee-ops/gose
home-assistant		stable	ghcr.io/deedee-ops/home-assistant
invidious-devel		devel	ghcr.io/deedee-ops/invidious-devel
jellyfin		stable	ghcr.io/deedee-ops/jellyfin
jellystat		stable	ghcr.io/deedee-ops/jellystat
lldap		stable	ghcr.io/deedee-ops/lldap
maddy		stable	ghcr.io/deedee-ops/maddy
mbsync-devel		devel	ghcr.io/deedee-ops/mbsync-devel
memos		stable	ghcr.io/deedee-ops/memos
miniflux		stable	ghcr.io/deedee-ops/miniflux
miniserve		stable	ghcr.io/deedee-ops/miniserve
navidrome		stable	ghcr.io/deedee-ops/navidrome
offlineimap-devel		devel	ghcr.io/deedee-ops/offlineimap-devel
paperless-ngx		stable	ghcr.io/deedee-ops/paperless-ngx
postgres-init		stable	ghcr.io/deedee-ops/postgres-init
postgres-logical-backup		stable	ghcr.io/deedee-ops/postgres-logical-backup
prowlarr		stable	ghcr.io/deedee-ops/prowlarr
prowlarr-devel		devel	ghcr.io/deedee-ops/prowlarr-devel
prowlarr-nightly		nightly	ghcr.io/deedee-ops/prowlarr-nightly
radarr		stable	ghcr.io/deedee-ops/radarr
radarr-devel		devel	ghcr.io/deedee-ops/radarr-devel
radarr-nightly		nightly	ghcr.io/deedee-ops/radarr-nightly
roundcube		stable	ghcr.io/deedee-ops/roundcube
script-exporter		stable	ghcr.io/deedee-ops/script-exporter
sonarr		stable	ghcr.io/deedee-ops/sonarr
sonarr-devel		devel	ghcr.io/deedee-ops/sonarr-devel
syncthing		stable	ghcr.io/deedee-ops/syncthing
talosctl		stable	ghcr.io/deedee-ops/talosctl
tika		stable	ghcr.io/deedee-ops/tika
wakapi		stable	ghcr.io/deedee-ops/wakapi

Credits

A lot of inspiration (and a lot of copy-pasting to be honest) are thanks to the hard work of onedr0p containers and home-ops infrastructure.