Tiny CLI Images — Minimal Docker and OCI Images

Minimal, secure, multi-architecture Docker and OCI container images for useful command-line tools. Images are published to GitHub Container Registry (GHCR) for linux/amd64 and linux/arm64. Release images run as non-root, include SBOM and provenance attestations, and are signed with Sigstore.

Principles

• One primary CLI per image
• Minimal runtime
• Non-root by default
• Multi-architecture
• Upstream artifacts verified by SHA-256
• SBOM included
• Build provenance included
• Keyless Sigstore signatures
• Immutable version tags
• No unnecessary shell or package manager

Container image catalog

Tool	Container image	Purpose	Platforms	Runtime
age	ghcr.io/unitmatrix/age	File encryption	amd64, arm64	scratch
xh	ghcr.io/unitmatrix/xh	HTTP client	amd64, arm64	scratch

age encryption container image

The age image packages the age encryption tool in a minimal, non-root container without a shell or package manager.

docker run --rm ghcr.io/unitmatrix/age:1.3.1-r1 --version

See the age image documentation for usage and release details.

xh HTTP client container image

The xh image packages the xh HTTP client in a minimal, non-root container with CA certificates for HTTPS requests.

docker run --rm ghcr.io/unitmatrix/xh:0.26.2-r1 \
  https://example.com

See the xh image documentation for usage and release details.

Development

Project decisions are documented in docs/PROJECT.md. Contributions and security reports are covered by CONTRIBUTING.md and SECURITY.md.